SSL/TLS errors block visitors from accessing your site securely and can be caused by several distinct issues. This guide covers the most common ones and how to diagnose each.
"NET::ERR_CERT_DATE_INVALID" / Certificate Expired
The certificate's validity period has ended. Check expiration:
echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -datesRenew immediately — see How to Renew and Auto-Renew Let's Encrypt Certificates, and verify the automatic renewal timer is actually active going forward to prevent recurrence.
"NET::ERR_CERT_COMMON_NAME_INVALID"
The certificate doesn't cover the domain/subdomain being accessed (e.g. certificate issued for example.com but visitor is on www.example.com). Reissue the certificate including all needed domains:
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com"NET::ERR_CERT_AUTHORITY_INVALID" (Self-Signed or Untrusted Certificate)
The certificate wasn't issued by a trusted Certificate Authority — common with self-signed certificates used for testing. Replace with a real certificate from Let's Encrypt (free) via Certbot; see How to Install Let's Encrypt SSL with Certbot (Nginx & Apache).
Mixed Content Warnings
The page loads over HTTPS but references some resources (images, scripts) over plain HTTP. Update all internal resource URLs to use HTTPS or protocol-relative paths, and check for any hardcoded http:// URLs in your site's database/configuration (common after migrating an existing site to HTTPS).
"SSL_ERROR_NO_CYPHER_OVERLAP"
The client and server can't agree on a supported encryption method — usually caused by an outdated client (very old browser/OS) or an overly restrictive server-side cipher configuration. Review your Nginx/Apache SSL configuration for excessively narrow cipher suite restrictions.
Certificate Chain Issues ("Incomplete Certificate Chain")
The server isn't sending the intermediate certificate(s) needed for browsers to fully validate the chain to a trusted root. Certbot handles this automatically in standard configurations; if manually managing certificates, ensure your configuration references the full chain file, not just the leaf certificate.
Certificate Renewal Failing Silently
sudo certbot renew --dry-runRun this proactively to catch renewal problems before the certificate actually expires — common causes include port 80 being blocked by the firewall or DNS no longer pointing to this server.
Diagnosing Any SSL Issue: Start Here
echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443This shows the full certificate chain and any handshake errors directly, often revealing the exact problem faster than browser error messages alone.
Using Online SSL Checkers
A dedicated SSL testing tool (search for "SSL Labs test" or similar) provides a detailed breakdown of certificate validity, chain completeness, and configuration issues — useful for a comprehensive one-time check beyond what command-line tools show at a glance.
Common Errors
Certificate looks fine in the browser but automated tools report an error — browsers cache certificate validation aggressively; test from an incognito/private window or a different tool to rule out stale caching.
FAQ
Why did my site suddenly show a certificate error with no changes on my end?
The most common cause is silent renewal failure — run certbot renew --dry-run to check, and verify DNS still points to the correct server.
Continue Reading
- How to Renew and Auto-Renew Let's Encrypt Certificates
- How to Install Let's Encrypt SSL with Certbot (Nginx & Apache)
- HTTP to HTTPS Redirect: Forcing SSL on Nginx & Apache
Browse more articles in SSL/TLS & Certificates.
