Certificate authority is invalid
NET::ERR_CERT_AUTHORITY_INVALIDThe browser can't trace the certificate back to a trusted authority, which is what happens with self-signed certs or a missing intermediate.
What it means
A certificate has to chain up to a root the browser already trusts. NET::ERR_CERT_AUTHORITY_INVALID means that chain broke. Either the certificate was signed by something the browser doesn't recognize (a self-signed cert, or a private internal CA that isn't installed on the device), or the chain is real but incomplete because the server forgot to send the intermediate certificate that links the leaf to the root.
When it happens
You'll see this on a development box or internal tool using a self-signed certificate, on a device that hasn't had a company's internal CA installed, or on a production site where the admin uploaded only the leaf certificate and left out the intermediate. The incomplete-chain case is sneaky because some browsers and operating systems cache intermediates from previous visits, so the site can work on your machine while failing on a fresh one.
How to fix it
- Run an SSL check from a clean machine to see whether the intermediate certificate is actually being served.
- If the intermediate is missing, install the full chain (leaf plus intermediates) on the server, usually by concatenating them into the certificate file your server points at.
- For a self-signed or internal-CA certificate, install that CA in the trust store of every device that needs access, or switch to a publicly trusted certificate for anything public-facing.
- Restart the web server after fixing the chain and retest from outside your network.
Check this site’s certificate
Paste the domain and Sitewell shows the certificate’s expiry, the hostnames it covers, the chain, and the issuer — enough to pin down what triggered this error. Free, no signup.
Related errors
NET::ERR_CERT_COMMON_NAME_INVALIDThe hostname you visited isn't covered by the certificate's names, so the browser treats it as the wrong certificate.
ERR_CERT_WEAK_SIGNATURE_ALGORITHMThe certificate was signed with an algorithm now considered too weak to trust, such as SHA-1.
NET::ERR_CERT_DATE_INVALIDThe certificate's validity dates don't line up with the current time, usually because it expired or the device clock is wrong.