Your Connection Is Not Private: Causes and Fixes
Your connection is not private means the browser could not verify the site's HTTPS certificate, so it stopped before sending anything. The NET::ERR_CERT code says why: the certificate expired, names a different domain, or comes from an untrusted issuer. A wrong device clock or a Wi-Fi login page causes the same warning.
| Code | Meaning | Who fixes it |
|---|---|---|
| NET::ERR_CERT_DATE_INVALID | Expired, or your clock is wrong | Visitor checks clock; owner renews |
| NET::ERR_CERT_COMMON_NAME_INVALID | Certificate is for another name | Owner adds the name, often www |
| NET::ERR_CERT_AUTHORITY_INVALID | Issuer not trusted | Owner installs a public cert and full chain |
| ERR_SSL_PROTOCOL_ERROR | TLS handshake failed | Owner fixes server TLS settings |
Updated
HTTPS certificates prove that the server really belongs to the domain in the address bar. When that proof fails, the browser cannot tell a misconfigured site from an attacker in the middle, so it blocks the page. On your own sites the fix is almost always on the server; as a visitor you should only proceed when you know why.
Inspect a certificate and trust one locally
See the names and dates a server presents
Replace example.com with your domain; the subjectAltName line lists every host the certificate covers.
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -dates -subject -ext subjectAltNameTrusted HTTPS for localhost with mkcert
mkcert -install adds a local authority to your system and browsers; the second command writes a key and certificate to use in your dev server.
mkcert -install
mkcert localhost 127.0.0.1 ::1Fixes for site owners
Test the domain with openssl or an online SSL checker to see the expiry date, the names covered and whether the intermediate certificate is sent. A missing intermediate makes some browsers and phones fail while others succeed, because only some can fetch it themselves.
After renewing, reload the web server so it picks up the new files. Certificates renewed on disk but never loaded keep serving the expired one.
Hosted platforms
Managed hosts issue and renew certificates for you. On We.Inc a certificate is created when a custom domain's DNS points at us, so a brand-new domain can show this warning for a few minutes until issuing completes.
How it works
- Click the warning's Advanced link and note the NET::ERR_CERT code.
- Check your device's date and time, then retry.
- On public Wi-Fi, open http://neverssl.com to trigger the network's sign-in page.
- If it persists on every network, the site's certificate needs fixing by its owner.
Tips
- Hotel and airport Wi-Fi intercepts the first request to show its sign-in page, which breaks HTTPS until you log in.
- Antivirus with HTTPS scanning installs its own certificate. If only one computer shows warnings everywhere, that feature is a prime suspect.
- A certificate for example.com does not cover www.example.com unless the name is listed. Request both names when issuing.
- Let's Encrypt certificates last 90 days. An auto-renewal job that silently stopped is the usual cause of a sudden date error.
Frequently asked questions
Is it safe to click proceed anyway?
Only on a site you control or a local test server. On a public site the warning means nobody can confirm who you are talking to, so do not enter passwords or card details.
Why do I get this on every website?
When all sites fail, the cause is your device: a wrong clock, a network sign-in page, or security software intercepting HTTPS. Fix the clock first, then try another network.
How do I fix NET::ERR_CERT_COMMON_NAME_INVALID on my site?
Reissue the certificate so it lists every host name visitors use, usually both the bare domain and www. Redirecting one name to the other does not help, since the browser checks the certificate before following any redirect.
How do I stop this warning on localhost?
Use mkcert, which creates a local certificate authority your machine trusts and issues a certificate for localhost. Plain http://localhost also works for most development without any certificate.
Related: Why does my website say not secure, SSL certificate types, This site can't be reached, www vs non-www.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
More in Guides
- 400 Bad Request: What Was Wrong With the Request
- 401 vs 403: Pick the Right Status for a Refused Request
- 403 Forbidden: Why the Server Refuses and How to Fix It
- 404 Not Found: Why Pages Go Missing and How to Fix It
- 404 Page Examples: 20 Designs With Copy-Paste Code
- 409 Conflict: When a Request Clashes With Current State
- 500 Internal Server Error: Finding the Real Cause
- 502 Bad Gateway: Meaning and Fixes
Product
Who It's For
- For Agencies
- For Freelancers
- For Hosting Providers
- For SaaS Platforms
- For Startups
- For Financial Services
- For Healthcare
Features
Resources
- Blog
- Help Center
- Free Business Tools
- Free UI Components
- Website Templates
- Template Collections
- Website Examples
- Guides
- Comparisons
- Alternatives
- Best Lists
- Reviews
- Pricing Guides
- Use Cases
- Glossary & Guides
- Integrations
- Developers
- Benchmark
- Windows App