NET::ERR_CERT_AUTHORITY_INVALID means the browser cannot verify who signed the SSL certificate on that site. It appears mainly in Chrome and Chromium when the chain of trust is broken, the certificate is self-signed, or the device's clock is wrong. For site owners, an incomplete certificate chain is by far the most common cause.
What Does This Error Actually Mean?
Every SSL certificate is issued by a Certificate Authority (CA). Browsers trust a set of root CAs pre-installed in the operating system. When the chain running from your certificate to a trusted root CA has a missing or broken link, Chrome displays this error.
The full message typically reads:
Your connection is not private
NET::ERR_CERT_AUTHORITY_INVALID
Do not confuse this with NET::ERR_CERT_DATE_INVALID (expired certificate) or NET::ERR_CERT_COMMON_NAME_INVALID (wrong domain). Each has a distinct cause and fix.
Most Common Causes (and Who They Affect)
| Cause | Affects site owner? | Affects visitor? |
|---|---|---|
| Incomplete certificate chain | Yes | No |
| Self-signed certificate in production | Yes | No |
| Private/internal CA not trusted publicly | Yes (corporate envs) | No |
| Wrong date/time on the visitor's device | No | Yes |
| Antivirus or proxy with SSL inspection | No | Yes |
| Outdated root certificate store | No | Yes |
How to Fix It as a Site Owner
1. Verify and Install the Full Certificate Chain
The most frequent cause is forgetting to install intermediate certificates. When you receive an SSL certificate, the CA provides three files: your certificate, the intermediate certificate, and the root certificate. The root is already in browsers — you must install yours plus the intermediate.
In Apache, SSLCertificateChainFile (or a concatenated SSLCertificateFile) must include the intermediate:
SSLCertificateFile /etc/ssl/yourdomain.crt
SSLCertificateChainFile /etc/ssl/intermediates.crt
In Nginx, the ssl_certificate file must be the full bundle (your cert + intermediates in that order):
ssl_certificate /etc/ssl/yourdomain_bundle.crt;
ssl_certificate_key /etc/ssl/yourdomain.key;
Check the chain with an SSL certificate diagnostics tool or run:
openssl s_client -connect yourdomain.com:443 -showcerts
If you see only one certificate in the output, the intermediates are missing from your server configuration.
2. Replace Self-Signed Certificates in Production
A self-signed certificate is not backed by any recognized CA. It is fine for internal development but must never be used on a public-facing site.
Fix: install a certificate from a recognized CA. Let's Encrypt is free and is built into most hosting control panels (cPanel, Plesk, DirectAdmin). If you need advanced features (organization validation, multi-level wildcards), evaluate a paid CA.
3. Confirm the Domain Name Matches the Certificate
If the certificate was issued for www.yourdomain.com but a visitor lands on yourdomain.com (no www), you may see this error alongside ERR_CERT_COMMON_NAME_INVALID. Ensure your certificate covers both variants, or use a wildcard certificate.
How to Fix It as a Visitor
Correct Your Device's Date and Time
Certificates have validity windows. If your computer's clock is off by several days, the browser may treat an otherwise valid certificate as outside its valid period. Open your system's date and time settings and enable automatic synchronization (NTP).
Update Your Operating System and Browser
Root certificate stores are updated alongside the OS. An unpatched Windows 7 machine or an outdated Linux distribution may not recognize modern CAs. Keep your system and browser current.
Check Whether Antivirus Is Intercepting Traffic
Some antivirus products (Avast, Kaspersky, ESET) inspect HTTPS traffic by inserting their own intermediate certificate. If the browser does not trust that intermediary, the error appears. Temporarily disable HTTPS inspection in your antivirus and see whether the error disappears.
Try a Different Network or Incognito Mode
Corporate proxies and some ISP routers perform SSL inspection. If the error disappears on a different network or via mobile data, the issue is with your network environment, not the website itself.
For broader context on how SSL certificates and certificate authorities work, see the SSL security guide.
Key Takeaways
- The error signals that the browser cannot verify the certificate's signing chain — it does not automatically mean the site is malicious.
- As a site owner, the most common cause is a missing intermediate certificate; install it in your server configuration.
- Self-signed certificates are fine for development; never use them in public production environments.
- As a visitor, start by checking your device's clock, then investigate whether your antivirus is intercepting HTTPS.
- The
openssl s_client -showcertscommand lets you diagnose the chain in seconds from any terminal.
If the error persists after reviewing your certificate chain, the team at elenlace.com can diagnose and fix your SSL installation without delay.
FAQ
Is it dangerous to bypass NET::ERR_CERT_AUTHORITY_INVALID?
On a third-party site you do not control, yes — the connection could be intercepted. On your own development server with a known self-signed certificate, the risk is low. Never bypass the error on sites where you enter passwords or payment details.
Can Let's Encrypt certificates trigger this error?
Yes, if the chain is not properly configured on the server. Let's Encrypt issues from an intermediate CA; if the server does not send that intermediate, devices that have not cached it will see the error. Verify the chain after every renewal.
Can the error appear on some devices but not others?
Yes. Devices running very old operating systems may lack an up-to-date root store, or a specific antivirus may be intercepting traffic. Test from a different device or network to isolate the problem.
How do I know whether my certificate chain is complete?
Run openssl s_client -connect yourdomain.com:443 -showcerts. You should see at least two certificates in the output (yours plus the intermediate). If you see only one, the intermediate certificate is missing from your server configuration.
Compare providers
Other providers and guides worth comparing:
