Reference

SSL & certificate errors

When a browser refuses to load a site over HTTPS, it throws one of these cryptic error strings. Most of them come down to a handful of causes: an expired certificate, a name that doesn’t match, a broken trust chain, or a clock set to the wrong day. Below is each common error in plain English, with what it means and how to clear it.

SSL
NET::ERR_CERT_DATE_INVALID

The certificate's validity dates don't line up with the current time, usually because it expired or the device clock is wrong.

SSL
NET::ERR_CERT_AUTHORITY_INVALID

The browser can't trace the certificate back to a trusted authority, which is what happens with self-signed certs or a missing intermediate.

SSL
NET::ERR_CERT_COMMON_NAME_INVALID

The hostname you visited isn't covered by the certificate's names, so the browser treats it as the wrong certificate.

SSL
ERR_SSL_PROTOCOL_ERROR

The TLS handshake fell apart before a secure connection could form, often from a protocol mismatch or a broken server config.

SSL
ERR_SSL_VERSION_OR_CIPHER_MISMATCH

The browser and server share no common TLS version or cipher suite, so they can't agree on how to encrypt the connection.

SSL
ERR_CERT_REVOKED

The certificate authority pulled this certificate back before its expiry date, so the browser refuses to trust it.

SSL
NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED

The certificate isn't backed by the public Certificate Transparency logs the browser now requires.

SSL
ERR_CERT_WEAK_SIGNATURE_ALGORITHM

The certificate was signed with an algorithm now considered too weak to trust, such as SHA-1.

SSL
SEC_ERROR_EXPIRED_CERTIFICATE

Firefox's way of saying the certificate is past its expiry date or the system clock is wrong.

SSL
SSL_ERROR_BAD_CERT_DOMAIN

Firefox's name-mismatch error: the certificate doesn't cover the hostname you're visiting.

Sitewell tool

Check a site’s SSL certificate

Paste a domain and Sitewell inspects its certificate: expiry date, the hostnames it covers, the chain, and the issuer. Free, no signup.