What Is NET::ERR_CERT_AUTHORITY_INVALID and How Do You Fix It?

NET::ERR_CERT_AUTHORITY_INVALID is an SSL error showing that the browser does not trust the organization (certificate authority) that issued a website’s SSL certificate. Chrome then shows the “Your connection is not private” page with the code NET::ERR_CERT_AUTHORITY_INVALID below it. In this guide we explain what the error means, why it happens and how to fix it as a visitor and as a site owner.

What Does ERR_CERT_AUTHORITY_INVALID Mean?

Every site opened over HTTPS presents an SSL/TLS certificate to prove its identity. The browser checks that this certificate is signed through a chain that leads up to one of the trusted root certificate authorities stored on the device. If the chain cannot be linked to a trusted root, the browser cannot be sure who issued the certificate and shows ERR_CERT_AUTHORITY_INVALID.

Causes of the Error

• Self-signed certificate: The server uses a certificate created by the server itself rather than by an authority. This is common on test servers and on router and device admin panels.
• Missing intermediate certificate: If the server sends only the site certificate and not the intermediate certificates, some devices cannot complete the chain.
• Untrusted or distrusted authority: Certificates from an organization that browsers no longer trust cause this error.
• Old device or operating system: Outdated devices may not have newer root certificates.
• Wrong date and time: If the device clock is wrong, the certificate chain may not be evaluated correctly.
• Software or network in the middle: Antivirus programs that inspect HTTPS traffic, corporate proxies and the login pages of public Wi-Fi networks can present their own certificates.

How to Fix It as a Visitor

1. Set the date and time automatically: Turn on automatic time under Settings > Time & language on Windows, or in the date and time settings on your phone.
2. Try a different network: If the error appears only on a hotel, cafe or office network, try mobile data. On public networks you may first need to open the login page and sign in.
3. Check your antivirus HTTPS scanning: Temporarily turn off the “HTTPS scanning” or “encrypted connection inspection” feature of your security software and try again.
4. Update the browser and system: Updates also refresh the list of trusted root certificates on the device.
5. Clear the SSL state and cache: On Windows, use Internet Options > Content > Clear SSL state, then clear the browser cache.

Important: Clicking through the warning with “Advanced > Proceed (unsafe)” means sending data without verifying that the connection really belongs to that site. Do not bypass the warning on pages where you enter passwords, card details or personal data. Continuing is reasonable only on local devices where you know the certificate is self-signed, such as your own router’s admin panel.

How to Fix It as a Site Owner

1. Use a certificate from a trusted authority: Instead of a self-signed certificate, install a trusted free or paid certificate such as Let’s Encrypt. For the options, see our article on free SSL.
2. Install the full chain: Add the intermediate certificates when installing the certificate. In Nginx, use the fullchain.pem file on the ssl_certificate line rather than only the site certificate; in Apache, define the intermediates with SSLCertificateChainFile or append them to the certificate file.
3. Test the chain: You can see the certificates the server sends with this command:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com -showcerts

The output should show the intermediate certificate next to the site certificate and end with Verify return code: 0 (ok). Also check the chain from outside with an SSL test tool. If you use cPanel, AutoSSL can install and renew the certificate automatically; we explain the steps in our article on automatically renewing an SSL certificate in cPanel.

If you use a CDN such as Cloudflare, the certificate the visitor sees is presented by the CDN; make sure the certificate is active for the domain and its subdomains in the CDN dashboard.

Similar Certificate Errors

For other errors, such as an expired certificate (NET::ERR_CERT_DATE_INVALID) or a certificate that does not match the domain (NET::ERR_CERT_COMMON_NAME_INVALID), and their fixes, see our guide what is an SSL error.

Conclusion

NET::ERR_CERT_AUTHORITY_INVALID shows that the site’s certificate cannot be linked to a trusted authority. On the visitor side, fixing the clock, changing the network and checking security software is usually enough. If you are the site owner, use a trusted certificate and install the full chain, including the intermediate certificates.