SSL certificate not trusted or invalid: causes and fixes

You open your site and, instead of the page, a full-screen warning appears: “Your connection is not private” in Chrome, or a potential security risk warning in Firefox, with a strange code underneath such as NET::ERR_CERT_DATE_INVALID. Most visitors close the tab right there, some of them customers who were about to buy. But the warning is no mystery: its causes are few, each leaves a sign in the error message, and each has a known fix. This guide explains what the warning means, walks through the causes one by one, and shows how to find the cause in seconds and fix it.

01What “Your connection is not private” means

When a browser opens a site over HTTPS, it asks for an SSL certificate proving that the server answering really owns the name, then asks three questions about it: is it still within its dates? Is the name the visitor typed written in it? Was it issued by someone the browser trusts? If any of them fails, the browser stops the page and shows the warning, because it can’t promise that nobody is intercepting the connection.

That’s why the warning looks the same whatever the cause, while the small code under it differs. Click “Advanced” or “Details” on the warning page to see it; it’s your first clue:

• The certificate has expired or isn’t valid yet, or the device clock is wrong: NET::ERR_CERT_DATE_INVALID in Chrome, SEC_ERROR_EXPIRED_CERTIFICATE in Firefox.
• The certificate doesn’t cover the name in the address bar: NET::ERR_CERT_COMMON_NAME_INVALID in Chrome, SSL_ERROR_BAD_CERT_DOMAIN in Firefox.
• The chain doesn’t reach a trusted issuer: A self-signed certificate or a missing intermediate: NET::ERR_CERT_AUTHORITY_INVALID in Chrome, SEC_ERROR_UNKNOWN_ISSUER in Firefox.
• The server doesn’t accept a modern TLS version: ERR_SSL_VERSION_OR_CIPHER_MISMATCH in Chrome, SSL_ERROR_NO_CYPHER_OVERLAP in Firefox.

02Cause one: an expired certificate

Every certificate has a start date and an end date. Once the end date passes without a renewal, the browser shows a full-page warning instead of your site. This is the most common cause, especially with certificates renewed by hand, or when automatic renewal quietly stops working.

• Renew or reissue the certificate: A paid certificate is issued for a full year, so set a reminder weeks before it ends. A free one needs renewing every 3 months, so make sure its automatic renewal really works.
• If your site is on our cPanel hosting: Open “SSL/TLS Status” in cPanel; a green mark beside the domain means it’s fully protected. AutoSSL renews the certificate before it expires, so if you find a domain without one, check that it points to your hosting.
• If it isn’t valid yet: Its start date hasn’t come, or the server clock is wrong. Set the server clock before reissuing anything.
• If only you see the warning: Check your device’s clock and date. A device with the wrong date sees every certificate as expired or not yet valid, so the same error shows on every site.

03Cause two: the certificate doesn’t cover the name

A certificate protects only the names written in it. If it was issued for saydaliya-homs.sy, a pharmacy’s site in Homs, and a visitor opens shop.saydaliya-homs.sy, they get a name-mismatch warning even though the certificate itself is fine.

• A single-domain certificate protects one name, usually written both with the www prefix and without it. Make sure both forms are in it; many visitors type the www.
• For many subdomains, choose a wildcard certificate, which protects the domain and all its subdomains; for several different domains, a multi-domain (SAN) certificate.
• If the name sits only in the Common Name field and not in the list of names (SAN), modern browsers reject the certificate: reissue it.
• On our cPanel hosting, every subdomain you add gets its own certificate through AutoSSL; the system may need a few minutes to issue it after the domain is connected.

04Cause three: a “not trusted” certificate

A browser doesn’t trust a certificate because it’s installed on your site, but because the chain of trust runs from it to a root certificate the browser already knows. Between your certificate and the root sit one or more intermediate certificates, and the server must send them along with yours. When the chain breaks, the browser says the certificate isn’t trusted:

• A missing intermediate: This happens often when a certificate is installed by hand on a VPS without its chain file (CA Bundle). Some browsers fill in a missing intermediate themselves, so the site opens for you and fails for others and in apps. The fix is to install the chain file that comes with the certificate.
• A self-signed certificate: It vouches for itself, so no browser trusts it. It’s fine for testing on your own machine, not for a site people visit. Replace it with a certificate from a trusted issuer.
• An untrusted root: The chain ends at a private or unknown issuer no browser knows, like the certificates of some devices and internal systems.
• An old signature: A certificate in the chain is signed with SHA-1 or MD5, which browsers reject because such signatures can be forged.

05Other causes that warn or hide the padlock

• An old TLS version: Current browsers can’t connect to a server that accepts neither TLS 1.2 nor 1.3; versions 1.0 and 1.1 are retired.
• Mixed content: The page itself is on HTTPS, but it loads an image or file over http://, so the padlock disappears or the browser blocks the file. Search your pages for links starting with http:// and change them to https://.
• No redirect to HTTPS: The site answers on http:// without redirecting, so anyone who types the bare name stays on an unencrypted connection. Add a permanent redirect to HTTPS, then an HSTS header for six months or more.
• A network that intercepts: Some company networks and security programs inspect connections with their own certificate, so the warning shows on that network only. Try another network before changing anything on your site.

06Find the cause in seconds

Instead of guessing, check your site with the SSL checker on Illevante’s site. Type the site’s name and it shows the certificate’s validity, its issuer, the chain of trust, the names it covers, the TLS versions and HSTS, with a grade from A+ to F, and you can save the result as a digitally signed PDF report. An F means the browser doesn’t trust the certificate: it has expired, doesn’t cover the name, or its chain doesn’t reach a trusted root.

ProblemThe warning shows on every site on one device

FixCorrect the device’s clock and date, then try again.

ProblemThe site opens without www and warns with it

FixUse a certificate that covers both forms, or reissue it to include www.

ProblemIt opens in your browser but fails in an app or on a phone

FixInstall the chain file (CA Bundle) with the certificate on the server.

ProblemThe certificate expired despite automatic renewal

FixCheck the domain still points to the server that renews it, then check the site after renewal.

ProblemNo padlock, though the page opens

FixFind images and files loaded over http:// and switch them to https://.

07Is a free certificate enough?

A free certificate encrypts the connection exactly as a paid one does, and it’s enough for most sites and blogs. But it’s limited to domain validation (DV) and needs renewing every 3 months. A paid certificate is issued for a full year and opens the OV and EV levels, which write your organization’s official details into the certificate: what shops and institutions need when they want customers to see who stands behind the site.

Illevante’s certificates come from Sectigo, DigiCert, GeoTrust, thawte and RapidSSL, at the DV, OV and EV levels, starting at $12 a year for PositiveSSL. A DV certificate is issued within minutes, while OV waits for the organization’s documents to be verified, and EV for its physical address and its representative’s authority.