Browsers report certificate problems with terse error codes that rarely explain what is wrong. This article is a reference: find the message your visitors see, and it tells you the actual cause and the fix. Most of these are five-minute problems once you know which one you have.
The error reference
| Error | What it means | Fix |
|---|---|---|
ERR_CERT_DATE_INVALID"Your connection is not private" |
The certificate has expired - or the visitor's own clock is wrong. | Check the expiry in SSL/TLS Status. If it is valid there, the problem is the visitor's device clock. |
ERR_CERT_COMMON_NAME_INVALID"does not match" |
The certificate does not cover the hostname requested. Usually www was omitted, or you are using the server hostname. |
Reissue covering both the bare domain and www, or re-run AutoSSL for the missing name. |
ERR_CERT_AUTHORITY_INVALID |
The issuer is not trusted - a self-signed certificate, or a missing intermediate chain. | Install a real certificate, or reinstall with the CA bundle included. |
| Works on desktop, fails on mobile | Missing CA bundle. Desktop browsers often fill the gap from cache; phones do not. | Reinstall the certificate with its intermediates in Manage SSL sites. |
ERR_SSL_PROTOCOL_ERROR |
The TLS handshake failed - often nothing is listening on HTTPS, or a proxy is interfering. | Confirm a certificate is installed for that domain. Disable any VPN or filtering proxy to test. |
ERR_TOO_MANY_REDIRECTS |
Conflicting HTTPS redirect rules, or Cloudflare set to Flexible SSL. | Keep one redirect rule only. On Cloudflare use Full (strict). |
| "Not secure" with no error page | The page loads over HTTP, or has mixed content. | See the mixed content and Force HTTPS article. |
ERR_CERT_REVOKED |
The authority revoked the certificate, typically because the key was compromised. | Generate a new key pair and request a fresh certificate. Treat the old key as exposed. |
ERR_CERT_SYMANTEC_LEGACY or similar distrust |
The issuing authority is no longer trusted by browsers. | Replace it. Our free certificate is trusted everywhere and costs nothing. |
Warning on yourdomain.com:2083 |
You are reaching cPanel through your domain before its certificate covers that service. | Use the server hostname URL from your welcome email, or log in through the client area. |
A three-step diagnosis
1. Confirm what is actually installed
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com < /dev/null 2>/dev/null \
| openssl x509 -noout -subject -issuer -datesThis tells you the covered name, the issuer and the validity dates - which usually identifies the problem immediately.
2. Check the chain
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com < /dev/null 2>&1 | grep -i "verify"Verify return code: 0 (ok) means the chain is complete. Anything else usually means a missing CA bundle.
3. Narrow down where it fails
- Everyone, everywhere - a genuine certificate problem. Work through the table above.
- One person only - their device clock, an antivirus product intercepting TLS, or a corporate proxy.
- Mobile only - missing CA bundle, near-certainly.
- One subdomain only - that name is not covered, or does not resolve.
- Only after a change you made - start by undoing it.
Errors that are not really your certificate
- Antivirus and security suites that inspect HTTPS insert their own certificate. If one machine sees an issuer you do not recognise, that is why.
- Corporate networks often do the same at the firewall.
- An incorrect device clock makes every certificate on the internet appear invalid.
- Very old devices may lack the modern root certificates entirely, and cannot be fixed from your end.
- Captive wifi portals intercept traffic before you have signed in.
Ask the affected person to try mobile data on a different device. If it works there, the problem is their environment, not your site.
Frequently asked questions
My site works for me but a customer sees a warning. Who is wrong?
Run an external SSL checker. If it reports a healthy chain and current dates, the problem is on their side - usually a clock, an antivirus product, or a corporate proxy.
What exactly is a CA bundle and why does it keep coming up?
Certificates chain from yours up to a root the browser trusts, via one or more intermediates. The CA bundle is those intermediates. Omit them and some clients cannot complete the chain - which is why the site works on your laptop and fails on a phone.
Can I just tell visitors to click Advanced and proceed?
No. It teaches people to ignore the one warning that reveals an intercepted connection, and any competent visitor will simply leave instead.
How do I stop this happening again?
Use the free automatic certificate wherever you can - it renews itself. For paid certificates, put a reminder in your calendar a month before expiry.
The certificate is valid but my mail client complains.
Mail uses a different hostname. Use the server hostname shown in cPanel under Email Accounts → Connect Devices, which always presents a valid certificate.
Does a certificate error mean my site is compromised?
Usually not - expiry and missing intermediates are far more common. But ERR_CERT_REVOKED, or an issuer you did not choose, deserves immediate investigation.
