Why is my SSL certificate not trusted?

The short answer: a browser says a certificate isn't trusted when it can't link the certificate to a root it already trusts, or when the certificate doesn't fit the site. The five common causes are: the server isn't sending its intermediate certificate, the certificate has expired, it was issued for a different name, it's self-signed, or the visitor's clock is wrong. The first is the most common, and it's fixed by installing the full chain file your certificate authority gives you, not just your own certificate.

This guide explains how certificate trust works, how to tell which problem you have, and how to fix each one.

How a browser decides to trust a certificate

Your website's certificate is signed by an intermediate certificate, which is signed by a root certificate. Browsers and operating systems ship with a list of trusted roots. When someone visits your site, the browser builds a chain from your certificate, through the intermediates, to one of those roots.

Your server is expected to send its own certificate plus the intermediates. The root is already on the visitor's device, so it doesn't need to be sent. If any link is missing, expired or doesn't match, the chain breaks and the browser shows a warning.

Cause 1: missing intermediate certificate

This is the classic "works on my computer" problem. Desktop browsers can sometimes find a missing intermediate on their own, because they've cached it from another site or can download it. Many phones, apps, scripts, payment gateways and older devices can't, so they report the certificate as untrusted. In Chrome the error is often NET::ERR_CERT_AUTHORITY_INVALID.

How to fix it: install the full chain. Certificate authorities usually supply two files:

• a file containing only your certificate, often called cert.pem or yourdomain.crt;
• a file containing your certificate followed by the intermediates, often called fullchain.pem or "certificate with chain".

Configure your server to use the full chain file. In cPanel, paste the intermediate into the Certificate Authority Bundle (CABUNDLE) box when you install the certificate.

Cause 2: the certificate has expired

Certificates are only valid between two dates. After the end date, every browser rejects them. Chrome shows NET::ERR_CERT_DATE_INVALID.

Expiry is becoming more common because certificates are getting shorter. Under the CA/Browser Forum's ballot SC-081v3, the maximum lifetime of a public certificate is coming down in stages. As Sectigo summarises, it fell to 200 days from 15 March 2026, falls to 100 days from 15 March 2027, and to 47 days from 15 March 2029.

How to fix it: renew and install the new certificate. Then make renewal automatic. Most hosts, including cPanel's AutoSSL, renew free certificates automatically, but automation breaks quietly when a domain moves or DNS changes. With lifetimes this short, manual renewal is no longer realistic for most sites.

Cause 3: the certificate is for a different name

A certificate lists the names it covers. If someone visits www.example.com but the certificate only covers example.com, the browser shows NET::ERR_CERT_COMMON_NAME_INVALID.

Common causes are:

• the certificate covers example.com but not www.example.com, or the other way round;
• a wildcard such as *.example.com, which covers shop.example.com but not example.com itself or a.b.example.com;
• a shared server sending another site's certificate, because the site isn't set up for HTTPS on that server;
• DNS pointing to an old server that still has an old certificate.

How to fix it: issue a certificate that includes every name visitors use, usually both the bare domain and www. If DNS points somewhere unexpected, fix DNS first.

Cause 4: self-signed or private certificate

A self-signed certificate is signed by itself, not by a trusted authority. Control panels, routers and new servers often use one by default. Browsers always warn about them on public sites.

How to fix it: replace it with a certificate from a public certificate authority. Free, automated certificates are widely available. Self-signed certificates are only suitable for testing on your own machine; Let's Encrypt's note on certificates for localhost explains the options.

Cause 5: the visitor's clock or software

If one person sees the warning on every site, the problem is probably their device, not your certificate.

• Wrong date or time: a clock set years out makes valid certificates look expired or not yet valid. Chrome shows NET::ERR_CERT_DATE_INVALID on every site.
• Old device: very old operating systems don't have newer root certificates and can't trust modern chains.
• Security software or work networks: some antivirus products and company firewalls inspect HTTPS traffic with their own certificate. If that certificate isn't installed properly, every site looks untrusted.

Should you use CAA records?

A CAA record, defined in RFC 8659, lists the certificate authorities allowed to issue certificates for your domain. Authorities must check it before issuing. It's a useful safeguard against a certificate being issued by mistake or by an attacker.

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issuewild ";"
example.com.  CAA  0 iodef "mailto:security@example.com"

Be careful: if you publish CAA records and later switch to a different certificate authority, or your host's AutoSSL uses a different one, renewal will fail until you add it. Check with the CAA Checker before changing provider.

Common questions

Is a free certificate less secure than a paid one?

No. The encryption is the same. Paid certificates may include extra checks on your organisation, a warranty or support, but browsers trust a free certificate from a public authority in exactly the same way.

Why does the warning appear only on www, or only without it?

Because the certificate doesn't list that name. Each name a visitor might type needs to be on the certificate, so include both the bare domain and www. Then redirect one to the other so visitors always end up on the same address.

Can visitors just click through the warning?

Some browsers let them, but they shouldn't have to. Many visitors will leave, and sites that use HSTS can't be clicked through at all. Fix the certificate instead.

How often should I check my certificate?

With lifetimes getting shorter, check after every renewal and whenever you change hosting, DNS or a content delivery network. A quick check takes seconds and catches a broken chain or a wrong name before visitors do.

Quick diagnosis table

Run the SSL Certificate Checker on the exact address visitors use. It shows the names on the certificate, the dates, who issued it and whether the server sends a complete chain.