Fix SSL certificate errors and HTTPS warnings
Fix HTTPS warnings on your site: name mismatch, expired or untrusted certificates, a missing chain, protocol errors, redirect loops and mixed content warnings.
- Intermediate
- 15 min read
- Updated
On this page
When HTTPS fails, the browser shows a full-page warning with an error code. That code tells you what is wrong. This guide shows how to read the certificate your server actually sends and how to fix the most common causes on hosting and on your own server.
Step 1: Look at the certificate the server sends
Open the site in a private window, click the site information next to the address and view the certificate. Or check it from a terminal:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltNameNote three things: the names in subjectAltName, the dates (notBefore, notAfter) and the issuer. To check the chain, run openssl s_client with -showcerts and look for Verify return code: 0 (ok) at the end:
echo | openssl s_client -connect example.com:443 -servername example.com -showcerts 2>/dev/null | grep -E "s:|i:|Verify return code"Step 2: Match the error to its cause
| Chrome error | Cause | Fix |
|---|---|---|
NET::ERR_CERT_COMMON_NAME_INVALID | The name you opened is not in the certificate, for example www.example.com on a certificate for example.com, or the server sends another site's certificate | Cover every name you use (see below); on your own server, check the server_name / ServerName / IIS host name of the HTTPS site |
NET::ERR_CERT_DATE_INVALID | The certificate has expired or is not valid yet, or the visitor's clock is wrong | Renew and install the new certificate; check automatic renewal; check the device clock |
NET::ERR_CERT_AUTHORITY_INVALID | The certificate is self-signed (for example a panel's temporary certificate), or the intermediate chain is missing | Install a certificate from a public authority with its full chain |
ERR_SSL_PROTOCOL_ERROR or ERR_SSL_VERSION_OR_CIPHER_MISMATCH | Port 443 does not serve TLS properly: no certificate bound, plain HTTP on 443, or only outdated protocols | Bind the certificate to the HTTPS site; allow TLS 1.2 and TLS 1.3 |
ERR_TOO_MANY_REDIRECTS | Two rules send the visitor back and forth between HTTP and HTTPS (or between www and the bare domain) | Keep one redirect rule; see the Cloudflare section below |
Other browsers show similar messages with their own codes; the causes are the same.
Cover every name you use
- Hosting: the free certificate covers the domains and subdomains that exist in your account and point to it, usually with
www. Add missing subdomains in the panel and make sure their DNS points to the hosting; see turn on free SSL and force HTTPS. - Paid certificate: order one that covers both
example.comandwww.example.com, or a wildcard for many subdomains; see order, validate and install an SSL certificate. - Server by IP address: public certificates are issued for domain names. Open the site by its name.
Install the full chain
The server must send your certificate and the intermediate certificates. On nginx, ssl_certificate points to the full chain (your certificate first, then the CA bundle). On Apache 2.4.8 and later, SSLCertificateFile can hold the full chain as well. On hosting panels, paste the CA bundle into its own field when you install a certificate by hand.
Verify: openssl s_client ends with Verify return code: 0 (ok).
Redirect loops with Cloudflare
If the domain runs through Cloudflare, check the SSL/TLS encryption mode:
- Flexible sends requests to your server over plain HTTP. If your server also redirects HTTP to HTTPS, the visitor goes round in circles. Switch to Full or Full (strict) once the server has a certificate, or remove the server's redirect.
- With Always Use HTTPS on, a server rule that sends HTTPS back to HTTP also loops. Remove that rule.
See Cloudflare setup.
The padlock is missing although the certificate is fine
The page loads some images, scripts or styles over http://. This is mixed content: browsers block insecure scripts and may block or upgrade other insecure files. Open the developer tools (F12), Console tab, to see the Mixed Content messages with the addresses. Change those links to https:// (or to relative links) in your site, theme or database. For WordPress, see turn on free SSL and force HTTPS.
Troubleshooting
The new certificate is installed but the browser still shows the old one. The web server was not reloaded, the certificate went to a different site, or Cloudflare serves its own edge certificate. Reload the service, check the binding and compare with openssl s_client.
Only some visitors see a warning. Their device clock is wrong, their software is very old, or their network inspects HTTPS. Ask for a screenshot of the error code.
You cannot click through the warning. The site sent HSTS earlier, so browsers insist on a valid certificate. Fix the certificate; do not try to turn HSTS off while the problem exists.
Next steps
- Validation problems while ordering: validate your domain for an SSL certificate.
- Install or renew a certificate: order, validate and install an SSL certificate.
Frequently asked questions
The warning appears only on my computer. Why?
Check your device's date and time first: a wrong clock makes valid certificates look expired. Antivirus software that inspects HTTPS, or a network that intercepts it, can also cause warnings for every site.
Can I tell visitors to click through the warning?
No. The warning protects them, and on sites that sent HSTS browsers do not offer a way past it. Fix the certificate instead.
Why does the site work with www but not without it (or the other way round)?
The certificate covers only one of the two names. Get a certificate that lists both, or redirect one name to the other after both are covered.
How do I see which certificate the server sends?
Open the site information next to the address in your browser and view the certificate, or use openssl s_client as shown in this guide.