ERR_CERT_AUTHORITY_INVALID usually means the browser cannot build a trusted certificate chain from your website’s certificate to a root certificate it trusts. The most common server-side fix is to install the site certificate together with every required intermediate certificate, then reload the web server. If the error appears only on one computer or network, investigate that client’s trust store, clock, antivirus HTTPS scanning, or a corporate proxy instead of changing the public certificate.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Do not solve a public-site warning by telling visitors to click “Accept the Risk” or create a permanent exception. That suppresses a security control rather than repairing the certificate. Use the workflow below to identify whether the fault is on the server, in the certificate chain, or on a particular client.
As an Amazon Associate I earn from qualifying purchases.
What ERR_CERT_AUTHORITY_INVALID means
When a browser opens an HTTPS site, it validates more than the certificate issued directly to your domain. It checks a chain of trust:
website certificate → intermediate CA certificate(s) → trusted root CA
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Chrome reports NET::ERR_CERT_AUTHORITY_INVALID when the presented certificate does not validate to a certificate in the Chrome Root Store or in the user’s local trust settings. Firefox performs the same basic trust evaluation: it checks the site certificate, any intermediate certificates, and a trusted root, while also checking that the certificate name matches the domain.
The authority error can occur when:
- The server sends the leaf (site) certificate but omits an intermediate certificate.
- The issuer is not trusted by the affected browser or operating system.
- The certificate is self-signed and is being used for a public website.
- A trusted root is missing or outdated on one device.
- An antivirus product, filtering gateway, or corporate proxy replaces the site certificate with its own certificate and the replacement root is not trusted.
- The wrong certificate or chain is configured on the server.
A hostname mismatch is a separate certificate error, but checking the hostname during troubleshooting prevents you from repairing the wrong problem.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →First determine whether the problem is global or local
Before changing server files, establish the error’s scope. A failure on every device points toward the certificate, chain, or server configuration. A failure on only one computer, browser, or office network usually points toward local trust or interception.
- Open the exact HTTPS URL in a second browser on the same computer.
- Retry in a private or Incognito window to reduce the effect of cached state and extensions.
- Test from a different device, preferably one using a different operating system.
- Test through a different network, such as mobile data instead of the office connection.
- Record whether the warning occurs for the bare domain, the
wwwhostname, a subdomain, or all of them.
Interpret the pattern carefully:
- Every browser and network fails: inspect the certificate and server chain first.
- Only one device fails: check its date and time, operating-system updates, local trust store, antivirus HTTPS protection, and installed proxy certificates.
- Only an office or managed network fails: investigate TLS inspection by the organization’s proxy or firewall.
- Only an older device fails: the server may be presenting a chain that device’s trust store cannot build, even though newer platforms accept it.
Inspect the certificate before changing anything
Use the browser’s certificate viewer from the warning page or the address-bar security control. The exact labels vary by browser version, but the viewer should expose the certificate subject, issuer, validity period, and certification path.
Record these fields
- Subject or DNS names: confirm that the requested hostname is covered. Include both the apex domain and any
wwwor subdomain the visitor uses. - Issuer: identify the certificate authority that signed the site certificate.
- Validity: check the “not before” and “not after” dates against the current date and time.
- Certification path: look for the leaf certificate, one or more intermediates, and the root the client is expected to trust.
- Server identity: make sure you are inspecting the certificate actually delivered by the public endpoint, not a local file or a different virtual host.
If the issuer is unknown, the path stops before a trusted root, or an intermediate is absent, the chain is the leading suspect. If the hostname is wrong or the dates are invalid, correct those conditions as well; installing an intermediate will not fix a name mismatch or an expired certificate.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Repair an incomplete or incorrect server chain
For a public website, configure the HTTPS endpoint to send the leaf certificate followed by every intermediate certificate required by the issuing authority. Browsers commonly have the root already, so servers normally should not send the root itself unless the certificate authority’s instructions explicitly require it.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Obtain the correct certificate files
Download the certificate and chain from the certificate authority or from the system that issued it. With ACME-based issuance, the download normally includes a chain. Let’s Encrypt explains that a typical chain consists of the end-entity certificate and one intermediate, and that presenting the complete chain lets browsers validate back to a trusted root.
Do not substitute an intermediate from another certificate, hostname, or issuance. Match the chain to the exact certificate and key currently deployed.
Install the files in the right order
- Back up the current certificate, key, and server configuration.
- Place the leaf certificate first in the certificate bundle.
- Append each required intermediate certificate in issuer order, moving toward the trusted root.
- Keep the private key separate and restrict its permissions according to your server’s operating requirements.
- Select the resulting bundle in your hosting panel or web-server TLS configuration.
- Reload or restart the HTTPS service using the platform’s documented procedure.
The bundle must be the certificate chain, not a file containing only the leaf certificate. A correct private key paired with an incomplete chain will still produce authority errors for clients that do not already possess the missing intermediate.
Verify what the server actually sends
After reloading, inspect the public endpoint rather than trusting the contents of a local file. An external TLS checker such as SSL Labs can reveal an “incomplete chain” result and show the certificates delivered to remote clients. Mozilla recommends this check when a site has chain issues.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
You can also inspect the handshake from a system with OpenSSL:
openssl s_client -connect example.com:443 -servername example.com -showcerts
Replace example.com with the affected hostname. Review the certificates printed by the command, confirm that the expected intermediate is present, and check the verification result from a client whose trust store represents your visitors. The command is diagnostic; it does not change the server configuration.
Choose a chain compatible with the affected platforms
Some incidents are not caused by a missing certificate but by serving a chain that a particular trust store cannot use. If current browsers work while an older operating system, embedded device, or managed client fails, compare the trust roots available on that platform with the chain your server presents.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Let’s Encrypt documents compatibility considerations for its ISRG Root X1 and ISRG Root X2 paths. The practical rule is to select the chain that reaches a root trusted by the oldest supported client, while retaining a modern, secure configuration for current browsers. A certificate authority or ACME client may expose alternate-chain choices; use the option documented for your exact issuance and server software rather than copying a bundle from an unrelated site.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
| Observed result | Likely explanation | Action |
|---|---|---|
| All current browsers fail | Missing intermediate, wrong certificate, expired certificate, or untrusted issuer | Inspect and replace the server bundle, then retest externally |
| New devices work; an older platform fails | The presented chain is incompatible with that platform’s trust store | Choose a documented alternate chain or update the affected platform |
| Only one managed network fails | TLS interception or an untrusted enterprise root | Have the network administrator verify its interception certificate and policy |
| Only one personal computer fails | Local clock, outdated trust store, antivirus scanning, or damaged browser state | Repair the client environment before changing the public certificate |
Fix client-side causes when the server is valid
Correct the system clock
Certificate validity is time-dependent. Verify the device’s date, time, and time zone, and enable the operating system’s automatic time synchronization where appropriate. A clock that is substantially ahead or behind can make an otherwise valid certificate appear not yet valid or expired.
Update the operating system and browser
Root certificates and TLS behavior are maintained through operating-system and browser updates. Install pending updates, restart the device if required, and test again. Updating is especially important on older systems whose trust stores predate the certificate chain used by your site.
Check antivirus HTTPS protection
Chrome specifically notes that antivirus software providing “HTTPS protection” or “HTTPS scanning” can cause this error. Such products decrypt and re-encrypt traffic with a locally generated certificate. Temporarily disable that feature only as a controlled diagnostic, then re-enable it and install the vendor’s current local root certificate through the approved administrative process if the feature is required. Do not leave HTTPS scanning disabled as the permanent answer without understanding the security and policy consequences.
Investigate enterprise TLS interception
Corporate gateways can substitute their own certificate for the public certificate so they can inspect encrypted traffic. Products and appliances from vendors such as Zscaler, Palo Alto Networks, or Fortinet may require an interception root certificate in the operating system or browser trust store. The organization’s administrator must distribute the correct root through its managed-device policy. Visitors to a public site should never be instructed to install an unfamiliar corporate root.
Rule out captive portals and extensions
On hotel, airport, or guest Wi-Fi, a sign-in portal may intercept the first HTTPS request. Complete the network login through the provider’s supported flow, then retry the site. Browser extensions and local security software can also interfere; use a clean private window or a managed test profile to isolate them.
Renew or replace the certificate when the certificate itself is wrong
Install a newly issued certificate when the current one is expired, self-signed for a public site, issued by a CA that the target browsers do not trust, or paired with the wrong private key. Select a CA trusted by the browsers and devices you need to support, complete the required domain validation, and deploy the new certificate with its complete intermediate chain.
After renewal, verify every endpoint that can serve HTTPS:
- the apex domain and
wwwhostname; - redirect targets;
- each relevant subdomain;
- load-balancer, CDN, reverse-proxy, and origin configurations;
- IPv4 and IPv6 addresses if they terminate TLS separately.
A frequent cause of “works on my computer” reports is that different DNS records or front ends serve different certificates. Compare the certificate issuer, expiry, and chain from each public route.
Why permanent bypasses are unsafe
“Accept the Risk,” “Proceed anyway,” and permanent browser exceptions disable or weaken certificate validation for that destination. Mozilla warns that an invalid certificate can indicate fraud or interception and that permanent exceptions reduce security. A warning on a public website should be fixed at the server or by correcting a legitimate client trust problem.
An internal, controlled service is different: an administrator may intentionally issue a private certificate and install the organization’s root certificate on managed clients. That arrangement must be documented, limited to the organization’s devices, and distributed through its approved management system. It is not a suitable workaround for public visitors.
Compare certificate and hosting solutions on the factors that matter
The cheapest certificate is not necessarily the least expensive to operate. Evaluate the complete delivery and maintenance process rather than the certificate label alone.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Evaluation axis | Questions to ask |
|---|---|
| Browser and device compatibility | Which current and legacy trust stores can build the supplied chain? |
| Complete intermediate chain | Does the service automatically provide the correct full chain, and is the order documented? |
| Renewal automation | Can issuance, installation, reload, and failure notification run without a manual certificate swap? |
| Alternate chains | Can you select a documented chain when older platforms require a different trust path? |
| Validation and identity | What domain validation is required, and does the certificate type match your site’s identity needs? |
| Monitoring and alerting | Will you be warned before expiry, chain changes, hostname coverage problems, or endpoint divergence? |
| Total operating cost | Include certificate fees, hosting or management charges, engineering time, monitoring, and outage risk. |
Automated ACME issuance can reduce renewal work, but automation is useful only when it also installs the chain correctly and alerts someone when validation or deployment fails. A manually renewed certificate with no monitoring can create the same outage months later.
Quick Recap
Prevent the error from returning
- Automate renewal and verify that the deployed certificate changes after each renewal.
- Monitor expiry dates with alerts that reach a person responsible for the endpoint.
- Run an external TLS check after certificate changes and on a recurring schedule.
- Test representative browsers, mobile devices, older supported platforms, and networks that use enterprise inspection.
- Keep an inventory of every TLS-terminating endpoint, including load balancers, reverse proxies, CDNs, and staging systems that are publicly reachable.
- Document which chain is deployed and why, especially when an alternate chain is selected for compatibility.
- Review DNS and IPv4/IPv6 endpoints so that every route serves the same intended certificate.
Troubleshooting checklist
- Confirm the exact hostname and whether the error is global or limited to a client or network.
- Inspect subject, issuer, dates, and certification path in the browser certificate viewer.
- Check the server bundle for the leaf certificate plus every required intermediate.
- Reload the TLS service and verify the certificates delivered from outside the server.
- Use an external checker to identify incomplete-chain or endpoint differences.
- If only some platforms fail, select a chain compatible with their trust stores or update those platforms.
- If only one client fails, correct its clock, updates, trust store, antivirus HTTPS scanning, or proxy configuration.
- Renew or replace the certificate when it is expired, self-signed, wrongly issued, or not trusted by the target audience.
- Remove temporary bypasses after the underlying cause is fixed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
