Certificate errors explained

Updated October 30, 2026 · 6 minute read · All guides

A full-page red warning, "Your connection is not private", and a site that was fine yesterday. The server is on. The browser is refusing it because the security certificate failed a check. Here is which check, and who fixes it.

What the certificate does

When a browser connects over https, the server presents a certificate: a file, signed by an issuer the browser trusts, that says "this key belongs to yourbakery.com, valid from this date to that date". The browser checks the dates, the name and the signature. Any of the three failing produces the warning, and the browser won't send anything, not even the page request, until you click through.

Most small sites use free certificates from Let's Encrypt, which last 90 days and are renewed automatically by the host. "Automatically" is the part that breaks.

The messages, and what each means

Message	Failed check	Usual cause
NET::ERR_CERT_DATE_INVALID, "certificate has expired", SEC_ERROR_EXPIRED_CERTIFICATE	Dates	Auto-renewal stopped. Or the visitor's device clock is wrong.
NET::ERR_CERT_COMMON_NAME_INVALID, "certificate is not valid for this name", SSL_ERROR_BAD_CERT_DOMAIN	Name	The certificate covers www.yourbakery.com but not yourbakery.com (or a new subdomain), or the name points at a server that serves another site's certificate.
NET::ERR_CERT_AUTHORITY_INVALID, "self-signed", "unknown issuer"	Signature	The server is presenting the host's placeholder certificate, usually right after a move to a new host, before the real one is issued. Or a company firewall is intercepting traffic.
ERR_SSL_PROTOCOL_ERROR, "secure connection failed"	Handshake	https isn't set up on the server at all, or a proxy such as Cloudflare is set to the wrong SSL mode.
Cloudflare error 525 or 526	Behind Cloudflare	Cloudflare reached the host but the host's certificate failed (526 invalid, 525 handshake). Fix at the host, or set the Cloudflare SSL mode to match.

If you're the visitor

• The warning is usually right. Don't type a password or card number on a site showing it.
• Check the date and time on your device. A wrong year makes every site look expired.
• Run the checker. Red at step 3 confirms the site's certificate is the problem, for everyone. Green means it's your device, your network or a firewall doing inspection; try mobile data.
• Tell the business. A certificate that expired overnight often goes unnoticed until a customer says so.

If it's your site

1. Open your hosting control panel and find the SSL or certificate section (cPanel: "SSL/TLS Status"; most managed hosts: a "Security" or "SSL" tab). Look at the expiry date and the names on the certificate.
2. Expired: click renew or reissue. If the button fails, the usual reason is that the domain's DNS no longer points at that host, so the issuer can't verify it. Fix the DNS first.
3. Wrong name: issue a certificate that covers both yourbakery.com and www.yourbakery.com, and any subdomain you use.
4. Placeholder or self-signed after a move: the new host hasn't issued one yet. Trigger it in the panel, or ask them. It takes minutes once DNS points there.
5. Behind Cloudflare: in the Cloudflare dashboard, SSL/TLS, set the mode to Full (strict) if the host has a valid certificate, or Full if it has only a self-signed one. Flexible causes redirect loops on sites that force https.
6. Check again from outside with the checker. Then set a reminder for 60 days out, or let a monitor remind you. DownInfo's monitoring will warn 30, 14 and 3 days before expiry.