When something is wrong with a site's SSL certificate, the browser shows a warning page with a cryptic code. The code tells you what is wrong, if you know how to read it. These are the ones you will meet most often, with the usual cause and the fix.

NET::ERR_CERT_DATE_INVALID: the certificate has expired

What it means: the certificate's validity dates do not include today. Most often it has expired. Less often it is not valid yet, or the visitor's own device clock is badly wrong.

What to do:

  • If it is your site: renew the certificate and reload the web server. See SSL certificate expired: how to fix it.
  • If only one visitor sees it: ask them to check the date and time on their device.

NET::ERR_CERT_COMMON_NAME_INVALID: the name does not match

What it means: the certificate was issued for a different address than the one the visitor typed. A certificate for example.com does not automatically cover www.example.com or shop.example.com unless those names are listed in it.

What to do: issue a certificate that includes every name you use (the "subject alternative names"), or a wildcard certificate for subdomains. Our free SSL certificate checker lists the names a certificate covers. Also check that the address points to the right server. A domain that points to a hosting server with a certificate for someone else's site will show this error.

NET::ERR_CERT_AUTHORITY_INVALID: the certificate is not trusted

What it means: the browser does not trust whoever signed the certificate. Common causes:

  • A self-signed certificate, which the server created for itself. Fine for testing, not for the public internet.
  • An incomplete chain. A certificate is trusted through a chain of "intermediate" certificates back to a trusted root. If the server does not send the intermediate certificates, some browsers and devices cannot complete the chain, so the site works for you and fails for others, especially on phones and older systems.
  • A certificate from an authority that is not trusted by the browser.
  • Software on the visitor's network that inspects encrypted traffic, such as some company firewalls.

What to do: install a certificate from a trusted authority, and make sure the server sends the full chain, usually by installing the "fullchain" file, not only the certificate itself. The SSL checker above shows whether the chain is complete.

NET::ERR_CERT_REVOKED: the certificate was cancelled

What it means: the authority that issued the certificate has revoked it, for example because the private key was exposed or the certificate was replaced.

What to do: issue and install a new certificate, with a new private key.

ERR_SSL_PROTOCOL_ERROR and ERR_SSL_VERSION_OR_CIPHER_MISMATCH

What it means: the browser and the server could not agree on how to encrypt the connection. Typical causes are a server that only supports obsolete protocol versions, a certificate that is not installed for that address at all, or a misconfigured proxy or CDN.

What to do: check that HTTPS is actually enabled for the address, update the web server's TLS settings to support current versions (TLS 1.2 and 1.3), and check any CDN or proxy settings in front of your site.

"Not secure" on a page with a padlock problem: mixed content

This is not a certificate error. The certificate is fine, but the page loads some images, scripts or styles over plain http://. Browsers mark the page as not fully secure or block those parts. Change the links to https://, and check your theme, plugins and database for hard-coded http:// addresses.

First steps for any SSL error

  1. Click the warning's details (or the padlock) to read the exact code.
  2. Check the certificate from the outside, not only in your own browser, which may have cached a good chain.
  3. Check every address you use, including www, the bare domain and subdomains.
  4. Check the dates, because an expired certificate is by far the most common cause.

Make sure you hear about it first

Certificate problems are one of the easiest outages to prevent, because the dates are known weeks ahead. ServerMonitor reads the certificate your visitors actually receive, checks the chain and the name, and warns you well before it expires, and again when it renews. See what to monitor on your website for how this fits with the other checks.