Fix NET::ERR_CERT_AUTHORITY_INVALID in Chrome (Every Cause)

You’re seeing this in Chrome:

Your connection is not private
Attackers might be trying to steal your information from example.com
(for example, passwords, messages, or credit cards).

NET::ERR_CERT_AUTHORITY_INVALID

The error page shows “This server could not prove that it is example.com; its security certificate is not trusted by your computer’s operating system.”

This means Chrome doesn’t trust the certificate authority (CA) that signed the site’s SSL certificate. The fix depends on whether you’re a visitor or the site owner.

Fastest Fix (Site Owner)

If you own the site, run this from any terminal:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -issuer -dates -subject

This tells you who issued the cert, whether it’s expired, and what domain it covers. Match the output to the causes below.

Fastest Fix (Visitor)

Try these in order — stop when one works:

1. Check your clock — Click the time in your taskbar. If it’s wrong, fix it (Settings → Time & Language → Sync now)
2. Try incognito mode — Ctrl+Shift+N. If it works there, clear your browser cache
3. Temporarily disable antivirus SSL scanning — Avast, Kaspersky, ESET, and Bitdefender all intercept HTTPS

If none of those work, the problem is on the server side and only the site owner can fix it.

How Chrome Validates Certificate Authority

Chrome checks the certificate against its trust store (which uses the operating system’s root CA list on Windows/Mac, or the Chrome Root Store on Linux). If any step fails, you get ERR_CERT_AUTHORITY_INVALID.

Cause 1: Self-Signed Certificate

What’s happening: The certificate was generated locally and isn’t signed by any public CA. Chrome will never trust it by default.

How to confirm:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -issuer -subject

If issuer and subject are identical, it’s self-signed.

Fix (site owner) — Replace with a real certificate:

# Install Certbot and get a free Let's Encrypt certificate
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

# Verify
sudo certbot certificates

Fix (visitor/developer) — Trust it locally for development only:

# Export the cert
openssl s_client -connect localhost:8443 2>/dev/null | openssl x509 -out dev-cert.pem

# Windows: Import to Trusted Root Certification Authorities
certutil -addstore "Root" dev-cert.pem

# macOS: Add to Keychain
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain dev-cert.pem

# Linux: Copy to trust store
sudo cp dev-cert.pem /usr/local/share/ca-certificates/dev-cert.crt
sudo update-ca-certificates

Never trust self-signed certificates on production systems. Use them only for local development.

Cause 2: Missing Intermediate Certificate

What’s happening: Your server sends the leaf certificate but not the intermediate CA certificate(s). Chrome can’t build the chain back to a trusted root.

How to confirm:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | grep -c "s:.*"

If you see only 1 certificate in the chain (just 0 s:), intermediates are missing.

Fix (Nginx):

# Download the intermediate from your CA's documentation
# Concatenate: leaf cert + intermediate(s) + (optionally) root
cat yourdomain.pem intermediate.pem > fullchain.pem

# Update nginx.conf
# ssl_certificate /etc/nginx/ssl/fullchain.pem;
# ssl_certificate_key /etc/nginx/ssl/yourdomain.key;

sudo nginx -t && sudo systemctl reload nginx

Fix (Apache):

SSLCertificateFile /etc/apache2/ssl/yourdomain.pem
SSLCertificateKeyFile /etc/apache2/ssl/yourdomain.key
SSLCertificateChainFile /etc/apache2/ssl/intermediate.pem

sudo apachectl configtest && sudo systemctl reload apache2

Fix (Let’s Encrypt/Certbot):

Certbot handles this automatically. If you’re seeing this error with Certbot, you likely configured ssl_certificate to point to cert.pem instead of fullchain.pem:

# Wrong:
ssl_certificate /etc/letsencrypt/live/yourdomain.com/cert.pem;

# Correct:
ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;

Verify the fix:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | grep "Verify return code"
# Should show: Verify return code: 0 (ok)

This is the most common cause of ERR_CERT_AUTHORITY_INVALID for site owners. See our certificate chain of trust guide for a deeper explanation.

Cause 3: Expired Certificate

What’s happening: The certificate (or an intermediate in the chain) has passed its expiration date.

How to confirm:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates

If notAfter is in the past, the cert is expired.

Fix:

# If using Certbot/Let's Encrypt:
sudo certbot renew --force-renewal
sudo systemctl reload nginx  # or apache2

# If using a commercial CA:
# 1. Generate a new CSR
openssl req -new -key yourdomain.key -out yourdomain.csr -subj "/CN=yourdomain.com"
# 2. Submit CSR to your CA for reissuance
# 3. Install the new certificate

Prevent this: Set up automated renewal with ACME or monitoring alerts at 30, 14, and 7 days before expiry. See our Certbot setup guide.

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | grep "issuer"

# Windows (via Group Policy or manually):
certutil -addstore "Root" internal-ca-root.pem

# macOS:
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain internal-ca-root.pem

# Linux (Ubuntu/Debian):
sudo cp internal-ca-root.pem /usr/local/share/ca-certificates/internal-ca.crt
sudo update-ca-certificates

# Linux (RHEL/CentOS):
sudo cp internal-ca-root.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

Settings → Time & Language → Date & Time → Sync now

w32tm /resync /force

# Check current time
timedatectl

# Enable NTP sync
sudo timedatectl set-ntp true

# Force immediate sync
sudo systemctl restart systemd-timesyncd

System Preferences → Date & Time → Set date and time automatically

# Open Internet Options
inetcpl.cpl
# Content tab → Clear SSL State

chrome://net-internals/#dns

# Quick check — should show "Verify return code: 0 (ok)"
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | grep "Verify return code"

# Full chain verification
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com -showcerts 2>/dev/null | grep -E "s:|i:"

# Check from a different network (use curl from a remote server)
curl -I https://yourdomain.com