"Your Connection Is Not Private" / NET::ERR_CERT Error and Its Solutions

When you see the "Your connection is not private" or NET::ERR_CERT_... error in your browser, the site won't open and visitors get scared. In this article, we cover the most common causes of this error and a definitive solution for each. First, look at the error code; the code points directly to the problem.

Read the error code

In Chrome-based browsers, there's a code beneath the error message. The most common ones are:

  • NET::ERR_CERT_DATE_INVALID → the certificate has expired (or the device clock is wrong).
  • NET::ERR_CERT_AUTHORITY_INVALID → the intermediate chain is missing or the authority is untrusted.
  • NET::ERR_CERT_COMMON_NAME_INVALID → the certificate doesn't match the domain (e.g., www isn't covered).

Cause 1 — Expired certificate

This is the most common cause. Free certificates are valid for 90 days; forgetting to renew produces this error. Check the validity date from the terminal:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates

If the notAfter date has passed, the certificate has expired. Solution: generate a new certificate with our free SSL wizard, download the ZIP, overwrite the old files on your server, and then reload the service.

If the error appears only on your device, the problem is most likely an incorrect system clock. Set your device's date/time automatically (NTP).

Image: <The Chrome "Your connection is not private" warning screen>
The NET::ERR_CERT error is mostly caused by expiry or the chain.

Cause 2 — Missing intermediate chain

Uploading only certificate.crt to the server and forgetting to add the CA Bundle / intermediate chain is the classic cause of this error. The interesting part is that the site opens in some browsers and gives ERR_CERT_AUTHORITY_INVALID in others; this is because some systems can complete the intermediate certificate from cache, while mobile browsers can't.

Solution — by server:

  • Nginx: For ssl_certificate, use fullchain.pem rather than certificate.crt on its own.
  • Apache: Define ca_bundle.crt in the SSLCertificateChainFile directive.
  • cPanel: Fill the CA Bundle box in the SSL/TLS manager with the contents of ca_bundle.crt.

To verify that the chain is fully served:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com -showcerts

In the output, you should see multiple BEGIN CERTIFICATE blocks, from the certificate down to the intermediate certificate. If there's only one block, the chain is incomplete.

Cause 3 — Domain mismatch

ERR_CERT_COMMON_NAME_INVALID indicates that the certificate doesn't cover the requested name. The most common scenario: the certificate was obtained only for yourdomain.com, but the visitor is going to www.yourdomain.com. Solution: when re-obtaining the certificate, check the "include the www subdomain too" option in the wizard; this way both names are covered.

Cause 4 — Mixed content

Even if the page itself is HTTPS, if some of its resources (images, scripts, styles) are still loaded over http://, the browser shows a warning instead of the lock and may block the scripts. You can find a detailed solution to this topic in our mixed content guide; the short fix is to make all resource addresses https://.

Quick checklist

  1. Read the error code (DATE / AUTHORITY / COMMON_NAME).
  2. Check the certificate's expiry with openssl ... -dates.
  3. Verify the chain with -showcerts; if it's missing, add the CA Bundle.
  4. Check whether www or additional domains are covered.
  5. Test the device clock and the cache (private tab).

Summary

The majority of NET::ERR_CERT errors come down to three causes: an expired certificate, a missing intermediate chain, and a domain mismatch. Read the error code and apply the relevant solution. You can use our free SSL wizard to renew the certificate or to include www, and for a missing chain you can upload the fullchain.pem or ca_bundle.crt file from the ZIP.