A TLS certificate error means your browser or app cannot verify that a site’s connection is trustworthy. Start by recording the exact error, checking your device’s date and time, and seeing whether the warning affects one site, several sites, or only a managed network. Correct the underlying clock, certificate, certificate chain, or network trust issue—don’t bypass the warning.
What a TLS certificate error means
TLS certificates help a browser verify that a server is authorized to represent the hostname you visited and that the connection meets applicable trust checks. Validation can fail because a certificate is outside its validity dates, does not cover the requested hostname, chains to an untrusted root, is missing an intermediate certificate, or has been revoked. Microsoft’s overview of certificate chain validation describes the checks involved, including the trust path, validity, revocation, and certificate policy.
As an Amazon Associate I earn from qualifying purchases.
The error may originate on your device, at the website, or on a network that inspects HTTPS traffic. The exact browser error and where it occurs help narrow down which party can fix it.
Start with these checks
- Write down the exact error code. Examples include
NET::ERR_CERT_DATE_INVALID,NET::ERR_CERT_AUTHORITY_INVALID, andNET::ERR_CERT_COMMON_NAME_INVALID. Different codes point toward different checks; they are clues, not a complete diagnosis. - Check the device’s date, time, and time zone. Correct them if needed, then reload the page. A wrong clock can make a valid certificate look expired or not yet valid. Chrome’s certificate error guidance specifically recommends checking the device date and time for date-invalid errors.
- Compare the pattern. Note whether the warning affects one hostname or many, whether it occurs in one app or browser, and whether it appears only on a work or school network. If practical, compare the same destination on a trusted second network.
- Contact the party that controls the failing configuration. A reader can correct their clock or intended hostname. The site operator must fix the site certificate or chain; an organization’s IT team must handle managed proxy inspection and trust settings.
Fix the error that matches your symptom
Date-invalid errors
For NET::ERR_CERT_DATE_INVALID or a message that the certificate has expired or is not yet valid, first verify the device’s date, time, and time zone. If they are correct, the site operator should check the certificate’s not-before and not-after dates and renew or correctly deploy a currently valid certificate. Microsoft’s AD FS certificate troubleshooting checklist includes checking expiration and whether a certificate is not yet valid.
#1 Best Overall
Authority-invalid or untrusted-issuer errors
NET::ERR_CERT_AUTHORITY_INVALID means the browser could not establish a trusted issuer path for the certificate it received. Possible causes include an untrusted root or an incomplete chain that omits an intermediate certificate. The site or proxy administrator should inspect the certificates being presented and repair the chain or the organization’s managed trust configuration. Microsoft’s certificate chain troubleshooting guidance explains how a missing intermediate can result in a partial-chain failure.
If this occurs on a work or school device, or only on that organization’s network, ask IT whether HTTPS inspection is enabled. An inspecting proxy presents its own certificate to the client, which must trust the organization’s correctly managed certificate authority. Chrome advises contacting the administrator when proxy configuration causes this error. Do not independently install a root or proxy certificate from an unknown source; Chrome warns that doing so can pose a security risk.
Hostname or common-name mismatch
For NET::ERR_CERT_COMMON_NAME_INVALID or a message that the certificate does not match the site, confirm that you entered the intended hostname rather than an obsolete alias. The service administrator should deploy a certificate covering the requested DNS name and verify the service’s certificate binding. Microsoft lists a mismatch between the certificate DNS name and service DNS name as a common certificate problem in its Windows Admin Center certificate guidance.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Missing intermediate certificate
A server may send its own certificate but omit an intermediate certificate needed to connect it to a trusted root. This is generally a server or proxy configuration problem, not something a visitor can reliably repair in the browser. The administrator should inspect the delivered chain and configure the service to supply the required intermediate certificates.
Rank #3
When the error appears only on one network or app
Compare the same hostname and device across a trusted second network, and note whether the device is managed. If many sites fail only behind a workplace or school network, proxy inspection or that environment’s trust configuration is a plausible cause. If a single hostname fails across networks, its certificate, chain, or server binding is a more likely place to investigate. These are triage clues, not proof; browser behavior and network configuration can vary.
- One site, multiple networks: ask the site operator to check the certificate dates, hostname coverage, revocation status, and delivered chain.
- Many sites, one managed network: ask IT whether HTTPS inspection is enabled and whether the managed trust configuration is functioning.
- One application only: give the application administrator the exact error and destination hostname; the app may use a different network path or trust configuration from your browser.
Microsoft’s proxy and firewall troubleshooting guidance covers how proxy configuration can affect connectivity. A network comparison can help locate the issue, but it does not establish the cause on its own.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How a site operator can inspect the TLS chain
An administrator can use OpenSSL’s s_client utility to inspect the connection and certificates presented by a TLS endpoint:
openssl s_client -connect example.com:443 -servername example.com -showcerts -verify_return_errorReplace example.com with the hostname being investigated. The -servername option sends the hostname for server name indication, while -showcerts displays certificates supplied by the peer. OpenSSL documents s_client as a test utility; without appropriate verification handling it may continue after certificate verification errors. A successful connection by itself does not prove the certificate is trusted. Consult the OpenSSL 3.6 s_client manual when interpreting the output.
Quick Recap
What not to do
- Do not click through a certificate warning just to reach the site. The warning means the browser could not verify an important part of the connection’s identity or trust.
- Do not import a root certificate from an unverified source. On a managed network, ask the administrator to confirm the approved trust configuration and installation method.
- Do not assume every authority error is a website problem. A proxy or local trust configuration can affect the certificate the browser sees.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
