Invalid SSL Certificate Warnings Explained

A browser trusts a website only when its certificate passes a set of checks: the right name, the right dates, and a chain of signatures that leads back to an authority the browser already knows. If any check fails, the visitor sees a warning instead of your homepage. This guide explains each failure in plain words.

Read the error code first

On the warning page, click Advanced or Show details. The short code is the best clue you have:

• NET::ERR_CERT_AUTHORITY_INVALID (Chrome, Edge) or SEC_ERROR_UNKNOWN_ISSUER (Firefox): the browser cannot connect the certificate to an authority it trusts. Usually a missing intermediate or a self-signed certificate.
• MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT (Firefox): the certificate was signed by the server itself.
• NET::ERR_CERT_COMMON_NAME_INVALID or SSL_ERROR_BAD_CERT_DOMAIN: the name does not match. See our guide to fixing a name mismatch.
• NET::ERR_CERT_DATE_INVALID: expired, or the visitor's clock is wrong. See what to do when a certificate expires.
• NET::ERR_CERT_REVOKED: the issuer cancelled the certificate. Get a new one issued and installed.

Missing intermediate certificate (a broken chain)

Certificate authorities do not sign your certificate directly with their main "root" key. They use an intermediate certificate in between. Your server has to send your certificate and that intermediate, so the browser can follow the chain up to a root it trusts.

When the intermediate is missing, the result is confusing: the site may work on your own computer, because some browsers fill in the gap from memory or fetch the missing piece, but fail on some phones, older devices, apps and testing tools. That is why "it works for me" is not proof that the certificate is fine.

Fix: install the full chain. With Let's Encrypt tools such as Certbot, point the server at the fullchain.pem file, not cert.pem. With a paid certificate, install the "bundle" or "CA chain" file the seller provides along with your certificate. Most hosting panels have a box for it.

Self-signed certificate

A self-signed certificate is one the server made for itself. It encrypts the connection, but nobody independent has confirmed who owns the site, so browsers do not trust it. Self-signed certificates are fine on a developer's own computer for testing. On a public website, they always cause a warning.

They often appear by accident: a new server ships with a temporary certificate, a control panel falls back to one when a renewal fails, or a device such as a router or booking system uses one. Fix: replace it with a certificate from a public authority. Free domain-validated certificates from Let's Encrypt or your host work in every major browser.

Other causes worth checking

• Old or weak certificate settings. Very old servers may offer outdated TLS versions or weak signatures that modern browsers refuse. The usual fix is a server or hosting update.
• A certificate for the wrong service. After a hosting move, the server may send a default certificate meant for the host's own address.
• The visitor's side. A wrong date on the device, antivirus software that inspects secure traffic, or a hotel or office network that intercepts connections can make a valid site look invalid. If only one person or one network sees it, start there.

"Not secure" but the certificate is valid?

If there is no full-page warning, only a Not secure label or a missing padlock, the certificate is probably fine. The usual cause is mixed content: an image, script or form on the page still uses http://. Our guide to the Not secure warning shows how to find and fix those files.

Free tools to test your certificate

1. Your browser's certificate viewer. Click the icon left of the address. It shows the names, dates and the chain.
2. An online SSL server test, such as Qualys SSL Labs. It flags chain problems ("incomplete chain"), wrong names, dates and old settings, with a simple grade.
3. The command line. openssl s_client -connect yourdomain.com:443 -servername yourdomain.com -showcerts lists every certificate the server sends. If you see only one, the intermediate is missing.
4. A real phone on mobile data. It is the quickest way to catch problems that your own computer hides.

When to ask for help

Get help if the test tools disagree with each other, if the warning appears only on certain devices, or if the server is old enough that nobody wants to touch it. A short check usually finds the cause quickly.