Seven Common SSL Certificate Errors and How to Fix Each One

Certificate errors look alarming, but nearly all of them map to one of a handful of causes. The frequent ones, in order of how often they appear in practice:

• ERR_CERT_AUTHORITY_INVALID: the served chain is incomplete (missing intermediate) or the certificate is self-signed. Fix: install the fullchain file — cert+intermediates — not just the leaf certificate. Test on a phone, which is less forgiving than desktop.
• ERR_CERT_DATE_INVALID: the certificate has expired (or is not yet valid — a wrong server clock causes the same error). Renew and reinstall; check date on the server if the new cert still fails.
• Hostname mismatch: the domain you opened is not in the certificate’s SAN list — typically www or a new subdomain added after issuance. Issue a new certificate covering every name you serve.
• Mixed content: the page is HTTPS but some images, scripts or fonts are pulled over HTTP, so the padlock breaks. Fix every resource reference — relative URLs or HTTPS — and add CSP upgrade-insecure-requests as a safety net while you clean up.
• ERR_SSL_VERSION_OR_CIPHER_MISMATCH: the server only speaks old TLS (1.0/1.1) or offers weak ciphers the browser refuses. Update the server configuration: TLS 1.2 minimum, TLS 1.3 preferred, modern cipher list.
• Slow TLS handshake: not an error, but a cost. Enable OCSP stapling and session resumption (tickets) to cut repeat-visit latency.
• Works everywhere except one network: usually a captive portal, corporate proxy or antivirus performing TLS interception with its own untrusted root — not your server at all.

After every fix, verify from the outside rather than from the server itself: SSL settings as seen from localhost are not what a visitor’s browser negotiates, especially with CDNs and load balancers in the path. The WhoDNS SSL check and TLS scan show the chain, expiry, protocol versions and ciphers exactly as clients see them — which turns each of the errors above from guesswork into a one-glance diagnosis.

🔗 Related tool: Diagnose your SSL configuration