Network tools Guides
Updated 23 September 2026
A "Your connection is not private" warning drives away almost every visitor. The cause is nearly always one of the five errors below, and each can be fixed in minutes once identified.
| Browser message | Cause | Fix |
|---|---|---|
NET::ERR_CERT_DATE_INVALID | Expired certificate, or the device's clock is wrong | Renew the certificate; on the visitor's side, fix the date |
ERR_CERT_COMMON_NAME_INVALID | The certificate does not cover this domain name | Issue a certificate that includes the exact name, with or without www |
ERR_CERT_AUTHORITY_INVALID | Self-signed certificate or incomplete chain | Use a recognised authority and install the intermediate certificates |
| Crossed-out padlock or partial "not secure" | Mixed content: images or scripts loaded over HTTP | Serve every resource over HTTPS |
ERR_SSL_PROTOCOL_ERROR | Wrong TLS configuration or outdated versions | Enable TLS 1.2 and 1.3, check port 443 |
This is by far the most common cause. Certificates have a limited lifetime, and it is getting shorter: the maximum dropped to 200 days in March 2026 and is due to fall gradually to 47 days by 2029. Renewal must therefore be automatic. Free Let's Encrypt certificates last 90 days and renew through an ACME client, often built into the host or CDN.
If renewal failed: check that the domain really points to the server (validation fails otherwise), that port 80 is open for HTTP validation, and run the client again.
A certificate lists the names it protects. A certificate for example.com does not cover www.example.com unless that name is in the certificate too. A wildcard *.example.com covers www and blog, but neither the bare domain nor a.b.example.com.
The server must send its certificate and the intermediate certificates. If one is missing, some browsers complete the chain on their own and show the site, while other devices, apps and command-line tools fail. Hence the famous "it works on my machine". Install the "fullchain" file provided by the authority.
An HTTPS page that loads an image, a font or a script over http:// is partly insecure. Browsers block mixed scripts and flag the rest. Replace http:// URLs with https:// in the code and database, or add the Content-Security-Policy: upgrade-insecure-requests header.
Our SSL checker shows the issuer, the names covered, the validity dates and the number of days left. Set a reminder one or two weeks before expiry, even if renewal is automatic: it is the safety net that prevents an outage on a Friday night.
It is often an incomplete chain: your desktop browser already has the intermediate certificate cached, the phone does not. Install the full chain on the server.
No. The encryption is identical. Paid certificates may add organisation validation or insurance, but the security of the connection is the same.
Ask them to check their device's date and time, then try another network: antivirus software or a corporate network that inspects HTTPS traffic can trigger these warnings.