SSL certificate errors, explained and fixed

First: look at the certificate from outside

Your browser shows the error code under the warning (click Advanced). Then read what your server really sends. This shows who the certificate is for, who issued it, its dates and every hostname it covers:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

And this shows the chain and whether it verifies (look for Verify return code: 0 (ok)):

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com </dev/null 2>/dev/null \
  | grep -E '^ *[0-9]+ s:|Verify return code'

NET::ERR_CERT_DATE_INVALID: expired (or a wrong clock)

The certificate’s notAfter date has passed, or, if only one visitor sees it, their device clock is wrong. Renew the certificate and reload the web server. If you use Certbot, check that the automatic renewal really runs:

sudo certbot renew --dry-run
systemctl list-timers | grep -i certbot
sudo systemctl reload nginx   # or: sudo systemctl reload apache2

Renewal is no longer a once-a-year job. Under the CA/Browser Forum rules, public certificates issued from 15 March 2026 are valid for at most 200 days; from 15 March 2027 the limit is 100 days, and from 15 March 2029 it is 47 days. Manual renewal won’t keep up, so use your host’s automatic certificates or an ACME client such as Certbot.

NET::ERR_CERT_COMMON_NAME_INVALID: wrong name

The certificate is valid, but not for the name in the address bar. Compare the address with the subjectAltName list from the first command. Typical causes: the certificate covers yourdomain.com but not www.yourdomain.com; a new subdomain was added without a certificate; or the server sends the certificate of another site on the same IP address (the default site). Reissue the certificate with every name you use:

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com --expand

If the names are right but you still get another site’s certificate, check that your server block or virtual host for this domain has its own certificate lines and the correct server_name.

NET::ERR_CERT_AUTHORITY_INVALID: untrusted issuer or broken chain

Either the certificate is self-signed (fine for testing, never for a public site), or the server sends only your own certificate without the intermediate certificate that links it to a trusted root. Some desktop browsers fill the gap themselves, so the site may work for you and fail on phones or in other tools. Always configure the full chain file:

# nginx
ssl_certificate     /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;

# Apache 2.4.8+
SSLCertificateFile    /etc/letsencrypt/live/yourdomain.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain.com/privkey.pem
SSLProtocol -all +TLSv1.2 +TLSv1.3

With a certificate bought from a commercial provider, download the “full chain” or “bundle” version and use it in place of the single certificate file.

ERR_SSL_PROTOCOL_ERROR and ERR_SSL_VERSION_OR_CIPHER_MISMATCH

The browser and server couldn’t agree on a protocol. Common causes: the server only offers TLS 1.0 or 1.1, which current browsers no longer accept; port 443 answers with plain HTTP; or the certificate and key don’t match. Test which versions your server accepts:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com -tls1_2 </dev/null 2>/dev/null | grep -E 'Protocol|Cipher'
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com -tls1_3 </dev/null 2>/dev/null | grep -E 'Protocol|Cipher'

Both should print a protocol and a cipher. Mozilla’s SSL Configuration Generator gives a current, tested configuration for nginx, Apache and other servers.

Cloudflare error 526 and redirect loops

With Cloudflare in front of your site there are two certificates: Cloudflare’s for visitors, and your server’s for the connection from Cloudflare. In Full (strict) mode, error 526 means your server’s certificate is invalid or expired; renew it, or install a free Cloudflare Origin Certificate. Avoid Flexible mode: the connection to your server is not encrypted, and combined with an HTTPS redirect on the server it causes ERR_TOO_MANY_REDIRECTS.

When the problem is on the visitor’s side

• A wrong date or time on the device produces date errors on every site.
• Antivirus or company “HTTPS inspection” replaces certificates and can trigger authority errors.
• Public Wi-Fi login pages intercept the first HTTPS request until the visitor signs in.

If only one person sees the error and the openssl checks above are clean, it is probably one of these.

What HackGrade checks

The free scan checks whether your certificate is trusted, warns when it expires within three weeks, and flags old TLS versions and a missing HTTP-to-HTTPS redirect. The Site, Business and Agency plans repeat the scan every week and send an alert when something changes. More background in Is my SSL certificate configured correctly?