Free tools Windows power users keep installed
One-click scans. No signup required.
Fix the certificate or trust chain before changing Puppeteer. Capture the exact Chromium error, verify the hostname, validity dates, intermediate certificates and proxy path from the same host or container that launches headless Chrome, then repair the public certificate or install the private CA in that runtime’s trust store. A certificate-ignore bypass is suitable only for a disposable test; it disables validation broadly and can conceal an expired, mismatched, revoked or intercepted certificate.
Identify the exact failure first
“SSL error” is not a single failure. The Chromium navigation code determines which layer needs attention. Log the complete exception rather than reducing it to a generic timeout.
| Chromium error or symptom | What it usually points to | First check |
|---|---|---|
net::ERR_CERT_AUTHORITY_INVALID |
The issuer is not trusted by the runtime, often because a private or self-signed CA is missing. | Which CA store the headless process uses, and whether a corporate proxy re-signs the connection. |
net::ERR_CERT_COMMON_NAME_INVALID |
The certificate name does not match the URL hostname. | The certificate’s Subject Alternative Name (SAN) entries and the exact hostname in page.goto(). |
net::ERR_CERT_DATE_INVALID |
The certificate is expired, not yet valid, or the runtime clock is wrong. | Validity dates and the clock inside the container or server. |
| TLS handshake or protocol failure | A lower-level negotiation, proxy or server configuration problem. | The same URL and network path with a TLS diagnostic tool from the launch environment. |
| Chrome will not launch | Missing shared libraries, an unusable sandbox, or read-only profile/cache paths. | Puppeteer’s Linux dependencies, writable directories and the selected executable. |
Compare a headful browser only after confirming that both attempts use the same URL, executable, profile, proxy variables, container image and CA material. “Works in Chrome” can mean that your desktop profile trusts a CA that the CI image does not.
Run a minimal, version-friendly diagnostic
Puppeteer launches headless mode by default; puppeteer.launch() is equivalent to {headless: true}. The following script keeps navigation, logging and cleanup separate from any workaround. Save it as an ES module such as diagnose.mjs and pass the target URL as the first argument.
#1 Best Overall
import puppeteer from 'puppeteer';
const target = process.argv[2] || 'https://example.test';
const browser = await puppeteer.launch({
headless: true,
// Set executablePath only when you intentionally manage the browser binary.
// executablePath: process.env.CHROME_PATH,
});
try {
const page = await browser.newPage();
await page.goto(target, {
waitUntil: 'networkidle2',
timeout: 30_000,
});
console.log('Loaded:', target);
console.log('Title:', await page.title());
} catch (error) {
console.error('Navigation failed:', error);
process.exitCode = 1;
} finally {
await browser.close();
}Run it against the exact failing hostname. Keep the original error text, the browser version, the value of any intentionally configured executablePath, and the proxy environment in your incident notes. Do not add a certificate flag while you are still trying to discover the cause.
Repair a public certificate or chain
Make the hostname match
Use the same DNS name in the URL that appears in the certificate’s SAN list. Changing the URL to an IP address or an alternate internal name will not repair a certificate issued only for the public hostname. If the name is wrong, obtain a certificate containing every hostname the automation actually visits and update DNS or routing consistently.
Renew dates and check the runtime clock
Renew an expired certificate and check that the container or server clock is correct. A certificate that is valid on a developer laptop can appear not-yet-valid in a machine with an incorrect time.
Send the complete intermediate chain
Public servers must present the leaf certificate together with every required intermediate certificate. Browsers sometimes appear to repair an incomplete chain from cached intermediates; a clean CI image may not. Inspect the endpoint from the same deployment environment and configure the server to send the complete chain.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Account for TLS-intercepting proxies
A corporate proxy can replace the public certificate with one signed by an internal CA. In that case, the public site may be correctly configured while Chromium still reports ERR_CERT_AUTHORITY_INVALID. Confirm whether the request passes through a proxy and install the organization’s issuing CA in the trust store used by the headless process, or configure the intended proxy path explicitly.
Use a private or self-signed service safely
Install the issuing CA where Chromium runs
For an internal service, add the CA—not merely the leaf certificate—to the operating-system or browser trust store used by the container or host. Build that trust material into immutable CI images through your normal secure secret and certificate-management process. Puppeteer’s Linux guidance identifies ca-certificates and libnss3 among the relevant dependencies.
Verify the installation from the same image that launches Chrome. A CA installed on your workstation does not affect a remote runner, serverless image or Kubernetes pod. After changing trust material, restart Chromium; an already running browser can retain its previous trust state.
Rotate and scope private trust
Keep private roots limited to the environments and services that need them, and rotate them through the same controlled process used for other deployment credentials. Do not commit a private key or a broad enterprise root to application source code. When a CA changes, rebuild or update the image, restart the browser, and rerun the diagnostic script before restoring normal jobs.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsUnderstand headless-versus-headful differences
Headless and headful failures usually reflect different runtime inputs rather than a special headless TLS rule. Compare these inputs directly:
| Input | How it can differ | What to align |
|---|---|---|
| Browser binary | Desktop Chrome may be newer or patched differently from the binary in CI. | Use a deliberate executablePath only when managing a system browser; otherwise keep Puppeteer’s compatible Chrome for Testing with the package version. |
| Profile and trust store | Your interactive profile may contain an imported corporate CA. | Use the intended profile/trust store in the headless image, and restart after trust changes. |
| Proxy route | Desktop settings and server environment variables can select different routes. | Check HTTP_PROXY, HTTPS_PROXY and NO_PROXY in the launching environment. |
| Container image | Minimal images may omit CA bundles, NSS libraries, fonts or other shared libraries. | Install the dependencies required by Puppeteer’s Linux guidance and pin the image. |
| Filesystem | Chrome cannot create a profile or cache in a read-only container. | Point XDG paths and userDataDir to writable locations. |
| Headless mode selection | The current headless mode and headless: 'shell' use different Chrome binaries. |
Choose deliberately and test the selected binary; changing mode is not a certificate repair. |
Use a certificate bypass only in a disposable test
The Chrome DevTools Protocol defines Security.setIgnoreCertificateErrors to enable or disable ignoring certificate errors. It is global to the debugging client: it does not distinguish one hostname, one request or one error type. That means it can hide expired, mismatched, revoked or proxy-intercepted certificates.
If a controlled test must exercise a private endpoint before its trust chain is available, apply the bypass immediately before navigation, document the target and reason, and run it only in an isolated environment:
import puppeteer from 'puppeteer';
const browser = await puppeteer.launch({ headless: true });
try {
const page = await browser.newPage();
const client = await page.target().createCDPSession();
await client.send('Security.setIgnoreCertificateErrors', { ignore: true });
await page.goto('https://example.test', {
waitUntil: 'networkidle2',
timeout: 30_000,
});
console.log('Test-only navigation completed');
} finally {
await browser.close();
}Remove this code before deployment and make the test target impossible to point at production. Older examples often pass ignoreHTTPSErrors to launch(); the current LaunchOptions interface does not list that option, so check the interface for the Puppeteer version you installed instead of copying a stale snippet.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
Fix launch and container prerequisites
Install the browser’s shared dependencies
Puppeteer normally downloads a compatible Chrome for Testing. A navigation error can be misleading when Chrome never starts correctly, so verify the Linux dependencies named in Puppeteer’s troubleshooting guidance, including ca-certificates, libnss3, fonts and other shared libraries required by your image.
Provide writable profile and cache paths
Chrome writes profile, configuration and cache data. In a read-only container, configure XDG directories and Puppeteer’s userDataDir to writable mounts. This is a runtime requirement independent of certificate validity.
Keep the sandbox enabled
Do not add --no-sandbox as a reflexive fix. The official warning is precise: “Running without a sandbox is strongly discouraged. Consider configuring a sandbox instead.” Configure the container permissions needed for the Chrome sandbox wherever possible.
Pin browser and Puppeteer versions
When you intentionally select a system browser, set executablePath and verify compatibility. Otherwise, keep Puppeteer, its downloaded Chrome for Testing binary, the CA bundle and the base image pinned together so an update does not silently change TLS behavior.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A repeatable troubleshooting sequence
- Capture the complete error. Separate certificate authority, hostname, date, handshake, proxy and browser-launch failures.
- Inspect the endpoint from the launch runtime. Check hostname, dates, chain completeness and proxy behavior from the same container or host.
- Repair public certificates. Renew expired certificates, correct SAN names and configure all intermediates on the server.
- Install private trust roots. Add the internal CA to the OS or browser trust store used by Chromium, then restart the browser.
- Check dependencies and writable paths. Confirm CA/NSS packages, fonts, shared libraries, profile directories and cache directories.
- Check browser selection. Verify the Puppeteer-managed browser or the deliberately configured
executablePath. - Check proxy and sandbox configuration. Compare
HTTP_PROXY,HTTPS_PROXY,NO_PROXYand sandbox permissions with the working environment. - Test headless mode again. Use the same URL, image, browser and trust material; retain the exact result.
- Only then run a bypass test. Keep it isolated, record the reason and remove it before any shared or production deployment.
Choose the remedy by security and ownership
| Approach | Best use | Main trade-off |
|---|---|---|
| Repair the certificate and chain | Production and shared environments | Requires control of the endpoint or certificate authority. |
| Install a private CA in the image or host trust store | Internal services and CI | Trust material must be managed and rotated securely. |
| Align browser, Puppeteer, proxy and writable runtime | Container and serverless failures | Requires deployment configuration work. |
| Temporary certificate bypass | Disposable, controlled tests only | Removes validation globally and can hide real security defects. |
The first three retain certificate validation and leave ownership with the server, image or deployment configuration that can actually be corrected. The last option belongs only in a narrowly controlled test.
Deployment, performance and reliability notes
Use a realistic navigation timeout and a wait condition that matches the page. networkidle2 is useful for pages that finish loading after a small number of requests, but a site with long-lived connections may never become idle; choose a selector wait or an explicit delay when that is the known page behavior. A timeout does not prove a certificate problem, so inspect the original exception before changing the wait strategy.
Rank #4
- 2-part carbonless unit set
- Consecutive numbering
- Includes Gift Certificates Available sign
- 25 certificates with envelopes per package
- White/canary form sequence
Keep browser startup outside a tight capture loop when possible, reuse a controlled browser process, and avoid sharing a mutable profile between unrelated jobs. Restart after CA, proxy or browser updates. In CI, pin the Puppeteer package, Chrome for Testing binary, base image and CA bundle as one tested unit.
Puppeteer’s installation guide estimates Chrome for Testing downloads of approximately 170 MB on macOS, 282 MB on Linux and 280 MB on Windows. These are package-size estimates, not performance measurements or error rates. If package-manager install scripts are blocked, use Puppeteer’s documented browser-install procedure explicitly or configure the cache and executable paths deliberately.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Or skip the browser setup
If your actual goal is a reliable website image or PDF rather than browser-level TLS debugging, ScreenshotNeo provides a one-request screenshot API and an MCP server for Claude, Cursor and other MCP clients. It is an alternative to maintaining Chromium, profiles and CA dependencies; it does not replace repairing a certificate when you own the failing service.
For a direct capture, see the ScreenshotNeo API documentation:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpimport requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' }); const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);- Before capture, it accepts the cookie or consent banner like a visitor and removes more than 60 known consent platforms, newsletter popups and chat widgets; each cleanup step can be turned off.
- Only clean shots are billed. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads and cache hits cost nothing, and the response reports the result through
X-Page-VerdictandX-Billedheaders. - The MCP server exposes
take_screenshot,get_page_infoandcapture_pdfto AI agents. - Features include full-page lazy-image capture, CSS-selector element capture, dark mode, device presets and custom viewports, retina scale, PDF paper and page controls, custom CSS and JavaScript, pre-capture clicks, selector or network-idle waits, request/resource blocking, custom headers, cookies, user agents, Authorization, timezone and geolocation, transparent backgrounds, resizing, configurable-TTL caching, signed links, asynchronous webhooks, bulk capture for up to 100 URLs per call, a usage API and an OpenAPI specification.
The free plan includes 1,000 screenshots per month with no card. Paid plans are $5 for 3,000 shots (Starter), $15 for 15,000 (Growth), $39 for 60,000 (Pro), $99 for 250,000 (Scale) and $249 for 1,000,000 (Business); yearly billing gives two months free, and every feature is available on every plan. Create a free ScreenshotNeo account to try the 1,000-shot allowance without adding a card.
FAQ
Does switching to headless: 'shell' fix certificate validation?
No. It selects the separate chrome-headless-shell binary. Trust still depends on that binary’s runtime, profile, proxy path and CA store, so changing modes should be treated as a comparison, not a repair.
Why must Chromium be restarted after adding a CA?
The running browser can retain its previously loaded trust state. Restarting ensures the next navigation reads the updated trust material from the intended store.
Can a certificate bypass be limited to one URL?
The DevTools setting is global to the debugging client, not a per-request switch. Isolation must come from the disposable environment and test design; do not assume the setting protects other navigations in the same client.
Frequently Asked Questions
Does switching to headless: ‘shell’ fix certificate validation?
No. It selects the separate chrome-headless-shell binary; trust still depends on that binary’s runtime, profile, proxy path and CA store.
Why must Chromium be restarted after adding a CA?
A running browser can retain its previously loaded trust state. Restarting makes the next navigation read the updated trust material.
Can a certificate bypass be limited to one URL?
The DevTools setting is global to the debugging client, not a per-request switch. Use an isolated disposable environment instead.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
