SSL Certificate Error on Your Website: What It Means and the Fix

A customer sends a screenshot: instead of your home page, they got a full-page warning that says "Your connection is not private," with a line of code underneath. Or you open your own site on your phone and hit the same wall. Nobody gets past that page without clicking through a warning, and a customer in a hurry may not bother. An SSL certificate error means the browser could not confirm the certificate your site uses to set up a private connection, so it stopped the visit before the page loaded. It can come from an expired certificate, a certificate that names a different address, or a trust problem the browser cannot resolve. It can also come from the visitor's own device or network, which changes what you should do first. On its own, the error does not show that your site was hacked. You can usually find out which problem you have in a few minutes, from the warning page itself.

What does an SSL certificate error mean for your website?

An SSL certificate is the file your site presents to a browser to prove it is the real address and to set up an encrypted HTTPS connection. The browser checks that certificate every time someone visits. It asks three things: is this certificate still in date, does it name the address the visitor typed, and was it issued by an authority the browser trusts? If any answer is no, the browser refuses to load the page normally and shows a full-page warning instead.

Chrome's help puts it this way: if you get a full-page error saying "Your connection is not private," then there's a problem with the site, the network, or your device. That sentence matters, because it gives you three suspects, and only one of them is your website. An expired certificate, a certificate that covers `example.com` but not `www.example.com`, or a server that does not send the full certificate chain are site problems. A wrong clock on a laptop, a hotel Wi-Fi sign-in page, or antivirus software that inspects secure connections are device or network problems.

The error is serious for the visit, even when nothing was stolen. The browser is correctly telling people not to trust the connection right now, so anyone trying to fill in your contact form, log in or pay should wait until it is fixed. What the error does not tell you is that someone broke into your site. Chrome uses a separate warning, labeled Dangerous, for pages its Safe Browsing service flags for malware or phishing.

If what you or your customer saw was only the words Not secure beside the address, with the page still loading underneath, that is a different and milder signal. It means the page is not using a private connection, often because it loads over plain HTTP. That label has its own causes and fixes, covered in why your website says Not secure. The rest of this page is about the full-page certificate errors that stop a visit cold.

Which warning are your customers seeing, and what does the code mean?

Each browser words its warning differently, and the exact wording is the fastest clue you have. Ask the customer for a screenshot, or reproduce it yourself, and look for the code. In Chrome it sits under the headline or behind the Advanced button. In Firefox it appears after you click Advanced. Safari words its warning in plain language, without a code. Once you have the code, the table below points you to the likely cause.

The Chrome wording and codes come from Chrome's list of common error messages, which groups "Your connection is not private," NET::ERR_CERT_AUTHORITY_INVALID, ERR_CERT_COMMON_NAME_INVALID and a general "SSL certificate error" together. For ERR_SSL_VERSION_OR_CIPHER_MISMATCH, Chrome's advice to site owners is to set the server to use TLS 1.3 and keep TLS 1.2 available for older devices.

Apple's support note on the Safari Not Secure warning, published July 14, 2026, lists four triggers: a certificate that is expired or illegitimate, a valid certificate running on TLS 1.1 or earlier, an unencrypted page asking for a password or card number, and a site that uses HTTP instead of HTTPS. Firefox stops the connection on a Warning: Security Risk page with the line "Be careful. Something doesn't look right." Mozilla's help on secure connection failures in Firefox tells visitors to contact the site's owner, which may be how the news reaches you.

Is the problem your website or just one visitor's device?

Before anyone touches your hosting, find out who else sees the warning. Every browser maker lists device and network causes first, and a fix aimed at the wrong place wastes the day. The test takes a few minutes and settles the question.

Test from two places at once

Open the exact address, starting with `https://`, on a phone using cellular data with Wi-Fi turned off. Then open it on a computer on your office connection. Try both versions of your address, with and without www, and try the pages that matter most: contact, booking, login and checkout. If the warning shows up everywhere, treat it as a site problem. If it appears on one device or one network only, the site is probably fine.

Rule out the visitor's clock

A device with the wrong date can make a perfectly valid certificate look expired. Chrome shows "Your clock is behind," "Your clock is ahead" or NET::ERR_CERT_DATE_INVALID in that case, and its fix is to correct the device's date and time. Mozilla's help on time-related errors on secure websites gives the same advice for Firefox. If only one customer sees an expiry error and your phone does not, ask them to check their clock.

Rule out Wi-Fi sign-in pages, antivirus and work networks

Hotel, airport and cafe Wi-Fi can need a sign-in before it lets secure connections through, and Chrome's first suggestion is to sign in to that portal. Antivirus that offers "HTTPS scanning" can trigger certificate errors, and Chrome notes that a work network proxy that inspects secure traffic can cause NET::ERR_CERT_AUTHORITY_INVALID. In those cases the visitor's IT support, not your host, owns the fix.

How do you check your SSL certificate yourself?

You do not need a developer to read a certificate. The browser will show you the details, and a free SSL certificate checker will test it the way visitors' browsers do. Write down what you find, because it is exactly what your host will ask for.

Read the details in the browser

In Chrome, click the icon to the left of the address, or open the warning's Advanced details. Chrome's help on checking whether a site's connection is secure explains what each connection state means. Record four things: the error code, the name or names on the certificate, the issuer, and the valid-until date. An expiry date in the past points to renewal. A name list that is missing the www version points to a reissue. An issuer you do not recognize on a work computer points to that network.

Run a free SSL certificate checker

Qualys SSL Labs' SSL Server Test is free. Type your domain and it reports the certificate, the chain of certificates behind it, and the protocol versions your server allows. It will flag an incomplete chain, one cause Mozilla gives for Firefox's SEC_ERROR_UNKNOWN_ISSUER, and old TLS versions, which explain Safari's TLS 1.1 warning. A checker only needs your public address. Never paste a private key or a hosting password into one.

Ask your host four questions

Send your host the error code, the affected address and what you found, then ask: Is renewal automatic for this certificate? Who receives the notice if renewal fails? Does the renewed certificate get installed automatically, or does someone have to deploy it? Are the www version, the bare domain and every subdomain covered? Clear answers to those four questions prevent the next warning as well as fixing this one.

What fixes each SSL certificate error?

Each cause has a known repair, and most of them are small jobs for whoever controls your hosting. The size of the job depends on how many pieces sit between your domain and your server, such as a CDN or a recent move. Work through them in this order, which starts with the causes that affect every visitor.

Expired certificate or failed renewal

Renew or reissue the certificate in your hosting control panel, or ask a managed host to do it. If the server's own clock is wrong, correct it. Then turn on automatic renewal and confirm that the new certificate is actually installed, since a renewal that is issued but never deployed leaves the old, expired one in place. This is usually a small task, provided the host can still validate your domain.

Wrong name on the certificate

Reissue the certificate so it lists every address you serve, typically the bare domain and the www version, plus any subdomains such as a booking or shop address. Then check that the web server or CDN hands out the right certificate for each name. This is also a small job in most setups.

A recent move to a new host

A move can leave your domain pointing at a server that has no certificate yet, or a CDN and the server behind it presenting different certificates. The safe order is to finish the certificate setup on the new host before the switch and test every address after it. Google's guidance on site moves and migrations covers the redirect side of a move. This can be a moderate to large job, because DNS, the CDN, the server and redirects all have to line up. If your web hosting setup has several of those layers and nobody is sure who owns the certificate, settle that first.

Plain HTTP, redirects and mixed content

If the site has no certificate at all, turn one on at the host and redirect every HTTP address to HTTPS with a permanent redirect. If the certificate is fine but a page pulls in images or scripts over HTTP, MDN's page on mixed content explains the fix: change those addresses to HTTPS. These usually show up as the milder Not secure label rather than a full-page error, and the cleanup can grow when plugins, embedded tools or old database content are involved.

What does an SSL certificate cost, and is a free one enough?

A certificate from Let's Encrypt costs $0, according to Let's Encrypt's documentation. A host may include a free certificate with the plan, in which case the cost sits inside the hosting fee you already pay. For an ordinary business website, a free, browser-trusted certificate gives the same encryption strength as a paid one when both are set up the same way. The padlock and the connection are identical to the visitor.

Paid certificates can still make sense, but for reasons other than stronger encryption. They can add vendor support, warranty or insurance terms, organization validation, where the issuer checks your business records, installation handled for you, easier management across many domains, or the paperwork a procurement department wants. If none of those matter to you, a free certificate is enough, and buying one will not clear an error caused by a wrong name or a failed renewal.

There is no single market price for a paid SSL certificate. The cost changes with the validation type, the number of names covered, the term and the reseller, so compare current prices on the seller's own page and note the date you checked. Before you pay for anything, confirm the fault. If your host's free certificate renews automatically and covers every address, the fix may be one setting, or nothing at all on your side.

Why do certificates expire sooner now, and what should you set up?

The CA/Browser Forum, the group of certificate issuers and browser makers that sets the rules for public certificates, has shortened how long a certificate may last. Ballot SC-081v3, published April 11, 2025, passed with 25 yes votes from certificate issuers and yes votes from all four browser makers that voted: Apple, Google, Microsoft and Mozilla. It cuts the maximum life of a newly issued certificate from 398 days in steps.

The first step is already in force, so any certificate issued since March 15, 2026 lasts 200 days at most. The rule caps how long a certificate may live. It does not mean you buy a new one every 47 days by hand. It does mean a yearly calendar reminder stops working, and a renewal process that fails quietly will fail more often, because it runs more often. The ballot also shortens how long an issuer may reuse the checks it did to confirm you own the domain.

What to set up is short. Automatic renewal through your host or a certificate tool, which Let's Encrypt lists in its client options. An alert that reaches a person who reads email, not a former employee's inbox. A check after each renewal that the new certificate is actually live on every address. Regular website maintenance can include that last check, so an expiry does not reach your customers before it reaches you.

When should you get help with an SSL certificate error?

You can do the first checks yourself: test from two devices, read the certificate details, run a free checker and ask your host the four questions. A certificate error can end there, with the host renewing, reissuing or turning on automatic renewal. Getting outside help makes sense when the error shows on every device and your host cannot give you a clear fix and a confirmed renewal, when nobody knows who controls the certificate, when a recent hosting move or CDN sits in the middle, or when the error blocks a form, login or payment page. The repair has to be made on the live setup and then checked from a visitor's side, on every address.

A certificate error on its own is not a sign of a break-in. If you also see things you did not change, such as new admin users, unknown files, strange redirects or a Dangerous warning from Chrome, treat that as a separate security problem and look at it before anything else.

Frequently Asked Questions About ssl certificate error

Does an SSL certificate error mean my website was hacked?

Not by itself. It means the browser could not validate the certificate or the connection, which can come from the site, the network or the visitor's device. Chrome shows a separate Dangerous warning for pages flagged for malware or phishing.

What is the SSL certificate meaning in plain terms?

It is the file your site presents to prove it is the real address and to set up an encrypted HTTPS connection. Browsers check that it is in date, names the address visited, and comes from a trusted issuer.

How do I use an SSL certificate checker?

Enter your domain in a free tool such as Qualys SSL Labs' SSL Server Test. It reports the certificate, the chain behind it and the protocol versions your server allows. Never enter a private key or password.

What does an SSL certificate cost?

Let's Encrypt certificates cost $0, and your host may include a free certificate in the plan. Paid prices vary by validation type, names covered, term and seller, and paid certificates do not encrypt more strongly.

What are the SSL certificate expiration changes?

Under CA/Browser Forum Ballot SC-081v3, new public certificates are limited to 200 days from March 15, 2026, 100 days from March 15, 2027, and 47 days from March 15, 2029. Automatic renewal is the practical answer.

Can customers keep using my site while the error shows?

They should not enter passwords, card numbers or personal details until the connection validates. Fix site-wide errors first on the pages that take forms, logins or payments.

The Bottom Line

An SSL certificate error stops a visit because the browser could not confirm your certificate, for example because it expired, names a different address, or cannot be traced to a trusted issuer. The code on the warning tells you which, and a test from a second device on a different network tells you whether the problem is your site or one visitor's screen. A free certificate encrypts as well as a paid one, so the fix is usually a renewal, a reissue or a setting rather than a purchase.

Once renewal runs by itself, alerts reach someone who reads them, and every address is covered, the warning stops being a surprise that a customer finds before you do. With certificate lives shrinking to 200 days now and 47 days by 2029, that setup is what keeps your contact form, booking page and checkout open.

If the error is on every device and your host cannot give you a clear fix, Web Leveling can find the cause and confirm the repair from a visitor's side, on every address. Our website security audit checks whether your certificate is valid and whether the protective settings a browser looks for are turned on, then ranks what it finds by how much it could cost you. If the answer is that your host's free certificate just needs one setting changed, we will say so. We work with small and medium businesses across the country and overseas. Send us the error code and the address that shows it, and we will tell you where the problem lives.

Terms