SSL Certificate Not Trusted (NET::ERR_CERT_AUTHORITY_INVALID)
Higher-risk issue — be cautious and consider professional help sooner.
Browsers warn that your site's security certificate is not trusted — usually NET::ERR_CERT_AUTHORITY_INVALID in Chrome — because the certificate was not issued by an authority the browser recognizes, or the chain behind it is incomplete.
Common signs of this issue
- Chrome or Edge shows "Your connection is not private" with the code NET::ERR_CERT_AUTHORITY_INVALID.
- Firefox shows "Warning: Potential Security Risk Ahead" with SEC_ERROR_UNKNOWN_ISSUER or MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT.
- Safari or an iPhone says "This Connection Is Not Private" or that the certificate is not trusted.
- The warning appears on some devices or browsers but not others — for example, fine on your laptop but broken on phones.
- It started right after moving hosts, installing a new certificate, or setting up the site on a new server.
- Online checkers or payment, email, or API services report that they cannot verify your certificate.
Safe checks you can do yourself
None of these require sharing passwords with anyone.
- Test from more than one place: your phone on mobile data, a different browser, and a different computer. If the warning appears only on one machine or one office network, the problem may be that device or network, not your website.
- Run a free check at SSL Labs (ssllabs.com/ssltest) or a similar SSL checker. Enter your domain and read the results for chain issues, incomplete chain, or not trusted. These tools test from the outside, the same way visitors see it.
- In the browser warning, click the details or the certificate information and look at who it was issued by. If the issuer is your own domain, your hosting company's server name, "localhost", or something like "cPanel" or "Plesk", it is a self-signed or default certificate rather than a real one.
- If the issuer is a well-known authority (such as Let's Encrypt, Sectigo, DigiCert, or Google Trust Services) but browsers still complain, the likely issue is a missing intermediate certificate — the server is not sending the full chain. Note this for your host or developer.
- If only your office computers show the warning, check whether antivirus software or a company firewall has an "HTTPS scanning" or "web shield" feature. These sometimes replace certificates with their own, which can trigger this error.
- Check the device date and time. A badly wrong clock usually causes a different date error, but it is quick to rule out.
- Log in to your hosting control panel and look at the SSL/TLS section (in cPanel, look for SSL/TLS Status or AutoSSL). See whether a valid certificate is listed for your domain, or whether it shows failures or a self-signed certificate.
- If you use Cloudflare, ask whoever manages it which SSL mode is set. A certificate warning from Cloudflare's side is handled differently from one coming from your own server.
What this usually means
Browsers keep a built-in list of trusted certificate authorities. A certificate is only trusted if it was issued by one of them, either directly or through an intermediate certificate the server sends along with it. NET::ERR_CERT_AUTHORITY_INVALID means the browser could not trace your certificate back to anything on that list. Visitors see a full-page warning, and most will leave rather than click through it.
On small business sites, the most common cause is a self-signed or placeholder certificate — what many servers use by default before a real one is installed, or when automatic issuance (like AutoSSL or Let's Encrypt) failed, often because the domain was not pointing at the server yet. The second most common cause is an incomplete chain: a real certificate was installed without its intermediate certificate, which some browsers can work around and others, especially on phones, cannot. That is why the warning can appear on one device and not another.
Less often, the cause is on the visitor's side: antivirus or a company network intercepting secure connections, or a very old device whose trusted list is out of date. If SSL Labs shows your certificate and chain as valid, and the problem is limited to one network or one old device, your site is probably fine. If the external check shows a problem, it is a server issue and needs fixing promptly.
What not to do
- Don't tell customers to click Advanced and Proceed anyway. It trains them to ignore real warnings and makes your business look unsafe.
- Don't install random certificate files sent by email or from an unknown source. Only use certificates from your host, your registrar, or a known authority.
- Don't share your hosting login or private key with anyone offering to fix it over email or chat. Ask your host directly instead.
- Don't turn off HTTPS or remove the redirect to make the warning go away. That exposes visitors and is treated as insecure by browsers and Google.
- Don't ignore it because it works on your own computer. Your browser may have cached a working chain that phones and new visitors do not have.
- Don't take payments or collect personal information on the site until the warning is gone.
When to get help
If your host's panel shows a valid certificate but SSL Labs still reports chain problems, or AutoSSL keeps failing and you do not know why, this is a good time to ask your host or a developer. Fixing a chain or reissuing a certificate is usually quick for someone who does it often, but guessing on a live site can take it fully offline or leave it half-working on mobile. Help is also worth it if the site sits behind Cloudflare or another proxy, because the right fix depends on how the two layers are set up, and getting it wrong can cause new errors like 525 or 526.
Not sure what to do next?
Answer a few short questions and we'll point you to the safest next step — DIY, a freelancer, or a direct review. No passwords required.
Is this a business website? If this issue may be costing you leads, sales, or trust, you may want a direct review instead of trial and error.
Frequently asked questions
What does NET::ERR_CERT_AUTHORITY_INVALID mean?
It means Chrome could not confirm your certificate came from a trusted certificate authority. Usually the certificate is self-signed, a server default, or missing its intermediate certificate.
Why does my site work on my computer but not on phones?
That is a classic sign of a missing intermediate certificate. Some desktop browsers can fill in the gap from memory or by fetching it, while phones and new visitors often cannot. An SSL Labs test will show chain issues.
What is a self-signed certificate?
A certificate that a server created for itself rather than one issued by a trusted authority. It encrypts the connection but browsers cannot verify it, so they show a warning. Real sites need a certificate from a recognized authority.
Is my site hacked if I see this warning?
Almost never. This error is usually a certificate setup problem, not a hack. Still, avoid entering passwords or payment details until it is fixed, and check it from more than one device and network.
How do I fix a certificate not trusted error?
Install a certificate from a trusted authority, or reinstall your existing one with its full chain. Many hosts do this automatically with AutoSSL or Let's Encrypt once the domain points correctly to the server, so start by asking your host.
Can antivirus cause this error?
Yes. Some antivirus programs and company firewalls scan secure connections by swapping in their own certificate. If only certain computers see the warning and external SSL checkers say your site is fine, that is a likely cause.