What Is an SSL Error? Common SSL Errors and How to Fix Them

An SSL error is the general name for warnings that show a browser or app could not establish a secure (HTTPS) connection to a server. When a connection is made, the server presents an SSL/TLS certificate, and the browser checks that certificate and the encryption methods both sides support. If any of these checks fail, the page does not open and an error code appears. In this guide we collect the most common SSL errors, what they mean and how to fix them as a visitor or as a site owner.

Why Do SSL Errors Happen?

For a secure connection, the browser verifies that the certificate was issued by a trusted certificate authority, that it has not expired, that it covers the domain being visited, and that both sides can agree on a common TLS version and cipher suite. Almost every SSL error comes from a problem with one of these four points.

The Most Common SSL Errors and What They Mean

Error	Meaning	Common cause
NET::ERR_CERT_DATE_INVALID	The certificate’s date is invalid	The certificate has expired or the device clock is wrong
NET::ERR_CERT_AUTHORITY_INVALID	The issuing authority is not trusted	Self-signed certificate, missing intermediate certificate
NET::ERR_CERT_COMMON_NAME_INVALID	The certificate does not cover this domain	www or a subdomain was not added to the certificate
ERR_SSL_PROTOCOL_ERROR	The secure connection handshake failed	Faulty server configuration, network or security software interference
ERR_SSL_VERSION_OR_CIPHER_MISMATCH	No common TLS version or cipher	The server supports only old protocols, the certificate is not installed yet
“Your connection is not private”	Chrome’s general warning for certificate errors	One of the NET::ERR_CERT errors above
SSL_ERROR_BAD_CERT_DOMAIN	Domain mismatch in Firefox	The certificate belongs to a different domain
Mixed content	An HTTPS page loads files over HTTP	Images, scripts or stylesheets called with http://

What Is ERR_SSL_VERSION_OR_CIPHER_MISMATCH and How Do You Fix It?

This error means the browser and the server could not find a common TLS version or cipher suite. Modern browsers no longer support TLS 1.0 and TLS 1.1, or weak ciphers such as RC4 and 3DES. If the server offers only these, no connection can be made. The error can also appear when a certificate has not been installed yet, or when a CDN has not issued a certificate for the subdomain being used.

For site owners:

• Enable TLS 1.2 and TLS 1.3 on the server and turn off SSLv3, TLS 1.0 and TLS 1.1.
• Use modern cipher suites (for example ECDHE- and AES-GCM-based suites) and disable RC4 and 3DES.
• Check that a valid certificate is installed for the domain and subdomain in question.
• If you use a CDN, make sure the certificate in the CDN panel covers that subdomain. Some CDNs’ free certificates do not cover second-level subdomains (for example a.b.yourdomain.com).
• After making changes, verify the configuration with an SSL test tool.

For visitors: Update your browser and operating system, check the device’s date and time, and try temporarily turning off the HTTPS scanning feature of your antivirus software. If the error appears on only one site, the problem is most likely on that site’s server.

ERR_SSL_PROTOCOL_ERROR

We explain the causes of this error, which means the secure connection handshake failed, and how to fix it step by step in our guide on fixing ERR_SSL_PROTOCOL_ERROR.

“Your Connection Is Not Private” and NET::ERR_CERT Errors

For certificate problems, Chrome shows the “Your connection is not private” page with a code below it, such as NET::ERR_CERT_DATE_INVALID, NET::ERR_CERT_AUTHORITY_INVALID or NET::ERR_CERT_COMMON_NAME_INVALID. The fix depends on what the code says: an expired certificate must be renewed, a missing intermediate certificate must be installed, or the domain must be added to the certificate.

SSL Errors in Email Apps

SSL errors do not only appear in browsers. The “Cannot Verify Server Identity” warning in the iPhone Mail app is also an SSL error related to the email server’s certificate. We explain its causes and fixes in our article on cannot verify server identity.

General Fixes for Visitors

1. Make sure the device’s date and time are set automatically.
2. Update the browser and operating system.
3. Try opening the page in a private window or a different browser.
4. Clear the browser cache and cookies; on Windows, use “Internet Options > Content > Clear SSL state”.
5. Temporarily turn off the HTTPS scanning feature of your antivirus or security software.
6. If you get the error on public Wi-Fi, try mobile data.
7. Do not click through the warning and continue to the site, especially on pages where you enter passwords or payment details.

General Fixes for Site Owners

1. Check the certificate’s expiry date and turn on automatic renewal. If you use cPanel, our article on automatically renewing an SSL certificate in cPanel will help.
2. Make sure the certificate covers both yourdomain.com and www.yourdomain.com, plus any subdomains you use.
3. Install the full certificate chain, including intermediate certificates.
4. Leave only TLS 1.2 and TLS 1.3 enabled on the server.
5. Load all images, scripts and stylesheets over HTTPS to remove mixed content warnings.
6. Redirect HTTP requests to HTTPS with a 301.
7. After making changes, check the configuration with an SSL test tool.

For free certificate options, see our article on free SSL.

Conclusion

An SSL error points to a certificate or protocol problem that prevents a secure connection. Reading the error code is the fastest way to tell whether the problem is the certificate’s expiry, the domain, the chain of trust or the supported TLS versions. For visitors, fixing the clock and updating the browser is often enough; the permanent fix is to correct the certificate and TLS configuration on the server.