Fixing Browser “Connection Not Secure” Warnings

Diagnose insecure-connection and privacy warnings caused by certificate or HTTPS configuration problems.

CertOneJan 11, 20204 min read

Warnings such as “Your connection is not private” disrupt access and undermine user confidence. This guide explains common causes and how to fix them.

1. Common browser warnings

1. Chrome and Edge

Warning messages:

“Your connection is not private”
"NET::ERR_CERT_AUTHORITY_INVALID"
"NET::ERR_CERT_DATE_INVALID"
"NET::ERR_CERT_COMMON_NAME_INVALID"

2. Firefox

Warning messages:

“Secure Connection Failed”
"SEC_ERROR_EXPIRED_CERTIFICATE"
"SEC_ERROR_UNKNOWN_ISSUER"
"SSL_ERROR_BAD_CERT_DOMAIN"

3. Safari

Warning messages:

“This Connection Is Not Private”
“Safari can't verify the identity of this website”

2. Understanding the causes

1. Expired certificate

Symptoms:

The browser reports an expired certificate
NET::ERR_CERT_DATE_INVALID is displayed

Causes:

The certificate has passed its expiration date
Renewal was not completed in time

Resolution:

Check the certificate validity period
Renew the certificate
Redeploy the certificate

2. Incomplete certificate chain

Symptoms:

The browser displays NET::ERR_CERT_AUTHORITY_INVALID
The site works in some browsers but not others

Causes:

The server does not send the complete certificate chain
An intermediate CA certificate is missing

Resolution:

Use the full-chain certificate file
Configure the server to send the intermediate chain
Verify the chain file

3. Hostname mismatch

Symptoms:

The browser displays NET::ERR_CERT_COMMON_NAME_INVALID
The certificate does not cover the requested hostname

Causes:

The certificate was issued for a different domain
The wrong certificate is installed

Resolution:

Make sure the certificate covers the requested hostname
Deploy the correct certificate
Check wildcard certificate coverage

4. Self-signed certificate

Symptoms:

The browser reports an untrusted certificate
Access requires a manually configured trust exception

Causes:

The server uses a self-signed certificate
The issuer is not a trusted CA

Resolution:

Use a certificate issued by a trusted CA
Request a free certificate from a CA such as Let's Encrypt
Use CertOne to request a free certificate

5. Mixed content

Symptoms:

An HTTPS page shows an insecure-content warning
Some resources fail to load

Causes:

The HTTPS page loads HTTP resources
Mixed content is present

Resolution:

Change all resource URLs to HTTPS
Use relative URLs where appropriate
Configure a Content Security Policy

3. Diagnostic steps

1. Inspect the certificate

Inspect in the browser:

Open the connection security information in the address bar
View the certificate details
Check the certificate validity period
Check the certificate's domain names

Inspect from the command line:

# Inspect certificate details.
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -text

# Check the certificate validity period
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

# Check the certificate chain
echo | openssl s_client -connect example.com:443 -servername example.com -showcerts

2. Use a TLS testing tool

SSL Labs:

Visit https://www.ssllabs.com/ssltest/
Enter your domain
Review the detailed report
Check the certificate chain, protocols, and cipher suites

Other testing tools:

SSL Checker: https://www.sslshopper.com/ssl-checker.html
Why No Padlock: https://www.whynopadlock.com/

Resolution

1. Expired certificate

Renew immediately:

Request a replacement certificate through CertOne
Download the new certificate
Install it on the server
Restart the web server

Automate renewal:

Enable automatic renewal in CertOne
Ensure renewal completes before expiration

2. Incomplete certificate chain

NGINX configuration:

server {
    listen 443 ssl;
    server_name example.com;
    
    # Use the full-chain file.
    ssl_certificate /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
    ssl_trusted_certificate /etc/nginx/ssl/chain.crt;
}

Apache configuration:

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    
    SSLCertificateFile /etc/apache2/ssl/cert.pem
    SSLCertificateKeyFile /etc/apache2/ssl/private.key
    SSLCertificateChainFile /etc/apache2/ssl/chain.crt
</VirtualHost>

3. Hostname mismatch

Check certificate hostnames:

# Inspect the names covered by the certificate.
openssl x509 -in certificate.crt -noout -text | grep -A 1 "Subject Alternative Name"

Resolution:

Make sure the certificate covers the exact requested hostname
Use a wildcard certificate for the appropriate subdomains
Use a multi-domain certificate for multiple names

4. Self-signed certificate

Obtain a trusted certificate:

Request a free certificate through CertOne
Request a free certificate from Let's Encrypt
Purchase a commercial certificate

Quick issuance:

CertOne: complete the request in a few minutes
Supports automatic validation with DNS authorization
Free of charge

5. Mixed content

Fix mixed content:

Replace HTTP resource URLs with HTTPS
Use relative URLs
Configure a Content Security Policy

NGINX configuration:

# Upgrade insecure requests.
add_header Content-Security-Policy "upgrade-insecure-requests" always;

Apache configuration:

# Upgrade insecure requests.
Header always set Content-Security-Policy "upgrade-insecure-requests"

5. Prevention

1. Choose a trusted CA

Certificate sources:

Let's Encrypt (free CA)
CertOne (free Let's Encrypt issuance service)
DigiCert (commercial CA)
Sectigo (commercial CA)

2. Configure the chain correctly

Serve the full chain:

Use a full-chain file containing intermediate CA certificates
Configure the server to send the intermediate chain
Check chain completeness regularly

3. Renew certificates regularly

Automatic renewal:

Automate renewal with CertOne
Automate renewal with acme.sh
Automate renewal with Certbot

4. Monitor certificate status

Set up monitoring:

Use CertOne site certificate monitoring
Set expiration reminders
Check certificate status regularly

6. Common error codes

1. NET::ERR_CERT_AUTHORITY_INVALID

Cause: an incomplete chain or untrusted certificate.

Resolution:

Use the complete certificate chain
Use a certificate from a trusted CA

2. NET::ERR_CERT_DATE_INVALID

Cause: the certificate is expired or not yet valid.

Resolution:

Renew the certificate
Check the system clock

3. NET::ERR_CERT_COMMON_NAME_INVALID

Cause: the certificate does not cover the requested hostname.

Resolution:

Deploy the correct certificate
Verify hostname coverage

4. NET::ERR_CERT_REVOKED

Cause: the certificate has been revoked.

Resolution:

Obtain a new certificate
Inspect the certificate

7. Testing and verification

1. Clear browser state

Steps:

Clear the browser cache
Clear cached SSL state where supported
Visit the website again

2. Test multiple browsers

Browsers to test:

Chrome/Edge
Firefox
Safari
Mobile browsers

3. Use a TLS testing tool

Testing tools:

SSL Labs SSL Test
SSL Checker
Why No Padlock

Best practices

1. Certificate management

✅ Use a trusted CA
✅ Configure the certificate chain correctly
✅ Renew certificates regularly
✅ Monitor certificate status

2. Server configuration

✅ Use secure TLS protocols
✅ Configure security response headers
✅ Enable HSTS
✅ Avoid mixed content

3. Monitoring and maintenance

✅ Set certificate expiration reminders
✅ Use automatic renewal
✅ Review TLS configuration regularly
✅ Verify with TLS testing tools

Conclusion

Browser security warnings commonly result from expired certificates, incomplete chains, hostname mismatches, or untrusted issuers. Correct configuration, trusted issuance, timely renewal, and monitoring help prevent them.

Key points:

✅ Use a certificate issued by a trusted CA
✅ Configure the certificate chain correctly
✅ Verify certificate hostname coverage
✅ Renew certificates regularly
✅ Avoid mixed content

CertOne provides free certificate issuance, management, and automatic renewal to help address these problems and prevent recurrence.

1. Common browser warnings​

1. Chrome and Edge​

2. Firefox​

3. Safari​

2. Understanding the causes​

1. Expired certificate​

2. Incomplete certificate chain​

3. Hostname mismatch​

4. Self-signed certificate​

5. Mixed content​

3. Diagnostic steps​

1. Inspect the certificate​

2. Use a TLS testing tool​

Resolution​

1. Expired certificate​

2. Incomplete certificate chain​

3. Hostname mismatch​

4. Self-signed certificate​

5. Mixed content​

5. Prevention​

1. Choose a trusted CA​

2. Configure the chain correctly​

3. Renew certificates regularly​

4. Monitor certificate status​

6. Common error codes​

1. NET::ERR_CERT_AUTHORITY_INVALID​

2. NET::ERR_CERT_DATE_INVALID​

3. NET::ERR_CERT_COMMON_NAME_INVALID​

4. NET::ERR_CERT_REVOKED​

7. Testing and verification​

1. Clear browser state​

2. Test multiple browsers​

3. Use a TLS testing tool​

Best practices​

1. Certificate management​

2. Server configuration​

3. Monitoring and maintenance​

Conclusion​

1. Common browser warnings

1. Chrome and Edge

2. Firefox

3. Safari

2. Understanding the causes

1. Expired certificate

2. Incomplete certificate chain

3. Hostname mismatch

4. Self-signed certificate

5. Mixed content

3. Diagnostic steps

1. Inspect the certificate

2. Use a TLS testing tool

Resolution

1. Expired certificate

2. Incomplete certificate chain

3. Hostname mismatch

4. Self-signed certificate

5. Mixed content

5. Prevention

1. Choose a trusted CA

2. Configure the chain correctly

3. Renew certificates regularly

4. Monitor certificate status

6. Common error codes

1. NET::ERR_CERT_AUTHORITY_INVALID

2. NET::ERR_CERT_DATE_INVALID

3. NET::ERR_CERT_COMMON_NAME_INVALID

4. NET::ERR_CERT_REVOKED

7. Testing and verification

1. Clear browser state

2. Test multiple browsers

3. Use a TLS testing tool

Best practices

1. Certificate management

2. Server configuration

3. Monitoring and maintenance

Conclusion