SSL Error Message Decoder

Explain browser SSL errors like ERR_CERT_COMMON_NAME_INVALID.

Codes the browser shows with the “Your connection is not private” warning — like ERR_CERT_COMMON_NAME_INVALID, ERR_CERT_AUTHORITY_INVALID or SEC_ERROR_UNKNOWN_ISSUER — point to SSL/TLS certificate problems. Enter the code and this tool explains what's wrong and how to fix it.

Operators get cause-specific fixes; visitors quickly learn why the warning appears.

Error codePaste the error code shown in your browser.

Domain name mismatch

Cause: The domain in the certificate (CN/SAN) doesn't match the one you visited. Common with www mismatches, wrong virtual hosts, or shared certs.

Fix: Reissue so all hostnames (apex and www) are in the certificate SAN, or bind the correct certificate to the host.

What each error code means

ERR_CERT_AUTHORITY_INVALID / SEC_ERROR_UNKNOWN_ISSUER: the issuer chain is not trusted — usually a missing intermediate certificate. Install the full chain on the server.
ERR_CERT_COMMON_NAME_INVALID / SSL_ERROR_BAD_CERT_DOMAIN: the visited domain is not in the certificate's SAN list (name mismatch). Confirm the correct domain is included in the SAN.
ERR_CERT_DATE_INVALID / SEC_ERROR_EXPIRED_CERTIFICATE: the certificate is expired or not yet valid. Check the device clock or the renewal status.
ERR_CERT_REVOKED: the certificate was revoked by the issuer. You must reissue a new one.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH: client and server share no common protocol or cipher. Verify supported versions with the TLS Version Check.

Top cause: missing intermediate certificate

If desktop browsers are fine but some devices/apps show “untrusted issuer,” the server likely has only the leaf certificate instead of the full chain. Install the intermediate certificates too. Inspect the chain the server actually sends with the SSL Certificate Checker, and the SAN and issuer inside a certificate file with the SSL Certificate Decoder.

If you're the visitor

When only one PC errors, its clock is often wrong, or antivirus/proxy is intercepting HTTPS.

Browser TLS error codes — meaning and fix at a glance

Here are the certificate errors Chrome and Edge throw most often, paired with what each means and how to resolve it. The same root cause can surface under different code names across browsers, so judge by the “Meaning” column rather than the exact string.

Error code	Meaning	Fix
`NET::ERR_CERT_DATE_INVALID`	Certificate expired, or the system clock is wrong	Renew the certificate, or correct the system date and time
`NET::ERR_CERT_AUTHORITY_INVALID`	Untrusted/self-signed issuer, or a missing intermediate	Install the full chain, or use a certificate from a trusted CA
`NET::ERR_CERT_COMMON_NAME_INVALID` / `SSL_ERROR_BAD_CERT_DOMAIN`	The hostname you visited is not in the certificate's SAN	Reissue the certificate with the correct SAN entries
`ERR_SSL_VERSION_OR_CIPHER_MISMATCH`	No TLS version or cipher in common	Enable TLS 1.2+ and modern cipher suites
`NET::ERR_CERT_REVOKED`	The issuer revoked the certificate	Reissue a new certificate
`ERR_CERT_WEAK_SIGNATURE_ALGORITHM`	Weak signature algorithm such as SHA-1	Reissue using SHA-256

Worked example: tracing NET::ERR_CERT_DATE_INVALID

Suppose you open a store and Chrome throws NET::ERR_CERT_DATE_INVALID. Walking through it step by step looks like this.

① Check the notAfter date — use the SSL Certificate Checker to read the server certificate's validity window. For example, notAfter = 2026-06-01.
② Confirm expiry — today is 2026-06-24, so the certificate expired 23 days ago. It is genuinely expired (not a clock problem on your side).
③ Renew and redeploy — renew the certificate at the CA, then deploy it to every node: web server, load balancer, and CDN. After it propagates, a hard refresh clears the warning.

If instead the error appears on a single PC while every other device is fine, notAfter is still in the future but that PC's date is set wrong. In that case fix the system clock, not the certificate.

Frequently asked questions

It errors only on my computer.

The device clock is likely wrong, or antivirus/proxy is intercepting SSL. Fix the time and check your security software's HTTPS scanning.

I use Cloudflare and still get errors.

Often the CDN SSL mode (Flexible/Full/Full Strict) doesn't match the origin certificate. Put a valid cert on the origin and use Full (Strict).

I renewed but still see an expiry error.

Make sure the new cert is deployed to every server/load balancer/CDN. If only some nodes updated, an old cert may still respond.

How do I fix a name mismatch (COMMON_NAME_INVALID)?

The domain you visit must appear in the certificate's SAN (alternative names) list. Check the www prefix, subdomains, and wildcard scope; if it is missing, reissue the certificate including that domain.

How do I handle a revoked (REVOKED) certificate?

A revoked certificate cannot be restored, so reissue and replace it with a new one from the CA. If the key may have leaked, issue it with a fresh key pair.