RunTheTests
/

SSL Error Message Decoder

What a certificate error actually means — which is rarely what people assume.

Matched in your browser — nothing is sent
Errors this recognises
  • The certificate was not issued by a trusted authority
  • The certificate does not cover this hostname
  • The certificate is expired or not yet valid
  • The certificate has been revoked
  • The browser and the server could not agree how to talk
  • The certificate breaks a browser policy rather than a standard
  • A network is intercepting the connection

How this check works

Paste the error and it is matched against the certificate and handshake failures browsers report. The explanation leads with what the error usually is rather than what it literally says, because those differ. ERR_CERT_AUTHORITY_INVALID reads as "an untrusted certificate authority" and is nearly always a missing intermediate certificate: the server sends its own certificate without the one that links it to a trusted root, so browsers that already cached that intermediate load the site fine and everyone else sees an error. That is why the fault so often "works for me".

What the results mean

Authority invalid
Usually a missing intermediate rather than an untrusted issuer. Test from a browser that has never visited the site.
Name mismatch
The certificate does not list the hostname. Note that only subject alternative names count — the legacy common name is ignored entirely.
Date invalid
An expired certificate, or a wrong clock on the machine. If every site fails at once, it is the clock.
Protocol error
The handshake failed before certificates came into it — no shared TLS version or cipher, which usually means one side is old.

Common problems and fixes

It works in my browser but not for customers
The signature of a missing intermediate. Your browser cached it from another site; theirs did not. Install the full chain.
The certificate is valid but the error persists
Reload the server after renewal — a renewed file on disk is not a renewed certificate in memory. Check any proxy or load balancer in front of it too.
Every site shows a certificate error on one device
That is a clock problem, not a certificate problem. A wrong date makes every certificate on the internet invalid.

Frequently asked questions

What does ERR_CERT_AUTHORITY_INVALID mean?

The browser could not build a chain of trust from the site's certificate to an authority it trusts. It reads as "untrusted certificate authority" and is usually simpler than that: the server is not sending the intermediate certificate that links its own to the root. Browsers that have picked up that intermediate elsewhere load the site normally, which is why the problem looks intermittent and is not.

Why does my certificate say the name does not match?

The hostname in the address bar is not among the certificate's subject alternative names. Common causes: www was left off, a subdomain was never added, or a server with several sites is answering with the wrong one. Modern browsers ignore the old common name field entirely, so a certificate that names the host only there will still fail.

Is it safe to click through a certificate warning?

Not on anything that matters. The warning means the connection cannot be verified as going where you think, which is exactly the condition under which credentials should not be typed. On your own server it is a fault to fix rather than an exception to add.

More in WebAudit