Weak signature algorithm
ERR_CERT_WEAK_SIGNATURE_ALGORITHMThe certificate was signed with an algorithm now considered too weak to trust, such as SHA-1.
What it means
Certificates are signed with a hashing algorithm, and older ones like SHA-1 have known weaknesses that make forgery feasible. Browsers dropped support for them. ERR_CERT_WEAK_SIGNATURE_ALGORITHM means the certificate, or something in its chain, was signed with one of these deprecated algorithms, so the browser rejects it regardless of whether it's expired or correctly named.
When it happens
This mostly shows up on certificates issued years ago and never replaced, or on internal certificates from an old private CA that still defaults to SHA-1. A long-lived self-signed certificate on a legacy device or appliance is a classic source.
How to fix it
- Reissue the certificate using a modern signature algorithm such as SHA-256.
- Check the whole chain, since a weak intermediate or root will trip the error even if the leaf is fine.
- For internal CAs, upgrade the CA to issue SHA-256 certificates and reissue anything it signed with SHA-1.
- Verify the new certificate's signature algorithm after installing it.
Check this site’s certificate
Paste the domain and Sitewell shows the certificate’s expiry, the hostnames it covers, the chain, and the issuer — enough to pin down what triggered this error. Free, no signup.
Related errors
NET::ERR_CERT_AUTHORITY_INVALIDThe browser can't trace the certificate back to a trusted authority, which is what happens with self-signed certs or a missing intermediate.
ERR_SSL_VERSION_OR_CIPHER_MISMATCHThe browser and server share no common TLS version or cipher suite, so they can't agree on how to encrypt the connection.
NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIREDThe certificate isn't backed by the public Certificate Transparency logs the browser now requires.