# Fix SSL certificate errors and HTTPS warnings > Fix HTTPS warnings on your site: name mismatch, expired or untrusted certificates, a missing chain, protocol errors, redirect loops and mixed content warnings. Difficulty: Intermediate When HTTPS fails, the browser shows a full-page warning with an error code. That code tells you what is wrong. This guide shows how to read the certificate your server actually sends and how to fix the most common causes on hosting and on your own server. ## Step 1: Look at the certificate the server sends Open the site in a private window, click the site information next to the address and view the certificate. Or check it from a terminal: ```bash echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName ``` Note three things: the **names** in `subjectAltName`, the **dates** (`notBefore`, `notAfter`) and the **issuer**. To check the chain, run `openssl s_client` with `-showcerts` and look for `Verify return code: 0 (ok)` at the end: ```bash echo | openssl s_client -connect example.com:443 -servername example.com -showcerts 2>/dev/null | grep -E "s:|i:|Verify return code" ``` ## Step 2: Match the error to its cause | Chrome error | Cause | Fix | |---|---|---| | `NET::ERR_CERT_COMMON_NAME_INVALID` | The name you opened is not in the certificate, for example `www.example.com` on a certificate for `example.com`, or the server sends another site's certificate | Cover every name you use (see below); on your own server, check the `server_name` / `ServerName` / IIS host name of the HTTPS site | | `NET::ERR_CERT_DATE_INVALID` | The certificate has expired or is not valid yet, or the visitor's clock is wrong | Renew and install the new certificate; check automatic renewal; check the device clock | | `NET::ERR_CERT_AUTHORITY_INVALID` | The certificate is self-signed (for example a panel's temporary certificate), or the intermediate chain is missing | Install a certificate from a public authority with its full chain | | `ERR_SSL_PROTOCOL_ERROR` or `ERR_SSL_VERSION_OR_CIPHER_MISMATCH` | Port 443 does not serve TLS properly: no certificate bound, plain HTTP on 443, or only outdated protocols | Bind the certificate to the HTTPS site; allow TLS 1.2 and TLS 1.3 | | `ERR_TOO_MANY_REDIRECTS` | Two rules send the visitor back and forth between HTTP and HTTPS (or between `www` and the bare domain) | Keep one redirect rule; see the Cloudflare section below | Other browsers show similar messages with their own codes; the causes are the same. ## Cover every name you use - **Hosting:** the free certificate covers the domains and subdomains that exist in your account and point to it, usually with `www`. Add missing subdomains in the panel and make sure their DNS points to the hosting; see [turn on free SSL and force HTTPS](/guides/hosting-free-ssl-https). - **Paid certificate:** order one that covers both `example.com` and `www.example.com`, or a wildcard for many subdomains; see [order, validate and install an SSL certificate](/guides/install-ssl-certificate). - **Server by IP address:** public certificates are issued for domain names. Open the site by its name. ## Install the full chain The server must send your certificate **and** the intermediate certificates. On nginx, `ssl_certificate` points to the full chain (your certificate first, then the CA bundle). On Apache 2.4.8 and later, `SSLCertificateFile` can hold the full chain as well. On hosting panels, paste the CA bundle into its own field when you install a certificate by hand. **Verify:** `openssl s_client` ends with `Verify return code: 0 (ok)`. ## Redirect loops with Cloudflare If the domain runs through Cloudflare, check the SSL/TLS encryption mode: - **Flexible** sends requests to your server over plain HTTP. If your server also redirects HTTP to HTTPS, the visitor goes round in circles. Switch to **Full** or **Full (strict)** once the server has a certificate, or remove the server's redirect. - With **Always Use HTTPS** on, a server rule that sends HTTPS back to HTTP also loops. Remove that rule. See [Cloudflare setup](/guides/cloudflare-proxy-setup). ## The padlock is missing although the certificate is fine The page loads some images, scripts or styles over `http://`. This is **mixed content**: browsers block insecure scripts and may block or upgrade other insecure files. Open the developer tools (F12), **Console** tab, to see the `Mixed Content` messages with the addresses. Change those links to `https://` (or to relative links) in your site, theme or database. For WordPress, see [turn on free SSL and force HTTPS](/guides/hosting-free-ssl-https). ## Troubleshooting **The new certificate is installed but the browser still shows the old one.** The web server was not reloaded, the certificate went to a different site, or Cloudflare serves its own edge certificate. Reload the service, check the binding and compare with `openssl s_client`. **Only some visitors see a warning.** Their device clock is wrong, their software is very old, or their network inspects HTTPS. Ask for a screenshot of the error code. **You cannot click through the warning.** The site sent HSTS earlier, so browsers insist on a valid certificate. Fix the certificate; do not try to turn HSTS off while the problem exists. ## Next steps - Validation problems while ordering: [validate your domain for an SSL certificate](/guides/ssl-domain-validation-methods). - Install or renew a certificate: [order, validate and install an SSL certificate](/guides/install-ssl-certificate). ## Frequently asked questions ### The warning appears only on my computer. Why? Check your device's date and time first: a wrong clock makes valid certificates look expired. Antivirus software that inspects HTTPS, or a network that intercepts it, can also cause warnings for every site. ### Can I tell visitors to click through the warning? No. The warning protects them, and on sites that sent HSTS browsers do not offer a way past it. Fix the certificate instead. ### Why does the site work with www but not without it (or the other way round)? The certificate covers only one of the two names. Get a certificate that lists both, or redirect one name to the other after both are covered. ### How do I see which certificate the server sends? Open the site information next to the address in your browser and view the certificate, or use openssl s_client as shown in this guide. --- Source: \ Updated: 2026-10-15