You've installed an SSL certificate, but the browser still shows "Not Secure" or a warning icon. This guide covers the most common reasons this happens and how to diagnose which applies to your situation.
Reason 1 — Mixed Content
The page loads over HTTPS but includes some resources over plain HTTP — see How to Fix Mixed Content Warnings After Enabling HTTPS for diagnosis and fixes.
Reason 2 — Certificate Doesn't Match the Domain
If your certificate covers example.com but the site is accessed as www.example.com (or vice versa) without both being included, browsers show a warning — verify your certificate's Subject Alternative Names (SANs) cover every variant your site is actually accessed by.
echo | openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -text | grep -A1 "Subject Alternative Name"Reason 3 — Expired Certificate
echo | openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -enddateSee How to Renew and Auto-Renew Let's Encrypt Certificates if expired, and How to Monitor SSL Certificate Expiration Automatically to prevent recurrence.
Reason 4 — Incomplete Certificate Chain
See Understanding Certificate Chains and Intermediate Certificates — a very common cause, often showing correctly in some browsers (which cache intermediates) while failing in others.
Reason 5 — Self-Signed or Untrusted Certificate
If you're using a self-signed certificate or one from a CA not trusted by the visitor's browser/OS, this warning is expected behavior — see Self-Signed Certificates: When and How to Use Them Safely for appropriate use cases.
Reason 6 — Weak/Deprecated TLS Configuration
Some browsers flag sites using outdated, insecure TLS versions or ciphers even if the certificate itself is otherwise valid — see TLS 1.2 vs TLS 1.3: Understanding and Configuring Modern TLS on Nginx & Apache.
Reason 7 — Certificate Revoked
If a certificate has been revoked (by the CA, for reasons such as suspected key compromise) it will show as invalid despite not technically being expired — check with your CA if this is genuinely unexpected.
Reason 8 — Browser Cache Showing Stale Information
Occasionally, a browser's own cache shows outdated certificate status even after you've fixed the underlying issue — try a hard refresh, incognito/private window, or a completely different browser to rule this out before further investigation.
Reason 9 — DNS Pointing to the Wrong Server
If DNS resolves to a different server than the one with your correctly configured certificate (e.g. an old server still active, or a CDN not yet properly configured with the certificate), you'll see certificate errors despite correct configuration on your intended server.
dig yourdomain.comSystematic Diagnosis Approach
- Check the specific browser error message/reason shown — it usually indicates which category above applies
- Run a comprehensive SSL test (see How to Test Your SSL/TLS Configuration for Security Issues) for a complete diagnostic picture
- Verify DNS actually points to the server you think it does
- Check the certificate details directly with OpenSSL to rule out expiration/domain mismatch
Common Errors
Works fine when tested from the server itself, fails for actual visitors — strongly suggests a DNS issue or CDN/proxy misconfiguration sitting between visitors and your actual server.
Continue Reading
- Common SSL Certificate Errors and How to Fix Them
- How to Test Your SSL/TLS Configuration for Security Issues
- Understanding Certificate Chains and Intermediate Certificates
Browse more articles in SSL/TLS & Certificates.
