Few things empty a website faster than a full-page browser warning: “Your connection is not private”. Most visitors won’t click past it, and they’re right not to. The good news is that SSL errors come from a short list of causes, and you can find out which one you have in a few seconds with our free SSL checker.
First: Is It Your Site or Your Device?
If the warning appears on one computer only, the problem may be on that device — most often a wrong date and time, which makes every certificate look expired or not yet valid. Antivirus software that inspects HTTPS traffic, and public Wi-Fi login pages, cause errors too.
Run your domain through the SSL checker. It connects from our servers, so if it shows everything green, the problem is local to the device showing the warning.
The Common Errors
NET::ERR_CERT_DATE_INVALID — Expired Certificate
The certificate has passed its expiry date (or, if the checker says it’s fine, the visitor’s clock is wrong).
Fix: renew it. Free certificates from cPanel AutoSSL and Let’s Encrypt last 90 days and renew automatically, so an expired one usually means renewal is failing — most often because the domain’s DNS no longer points at the server, so the domain check can’t complete. In cPanel, open SSL/TLS Status to see the reason and click Run AutoSSL once it’s fixed. Paid certificates need renewing (or reissuing) before they run out; since March 2026 a single certificate can last at most 200 days, and that limit keeps falling.
NET::ERR_CERT_COMMON_NAME_INVALID — Wrong Name
The certificate is valid, but not for the address in the browser. Classic examples:
- The certificate covers
example.co.ukbut the visitor typedwww.example.co.uk. - The domain was just added to the hosting account and AutoSSL hasn’t issued its certificate yet, so the server shows its own default certificate.
- DNS points at the wrong server, which answers with a certificate for a different site.
Fix: make sure every name visitors use is on the certificate. On cPanel, AutoSSL covers the domain and www automatically once both point at the server. The SSL checker lists every name the certificate covers, and warns when www is missing.
NET::ERR_CERT_AUTHORITY_INVALID — Not Trusted
Browsers don’t trust whoever issued the certificate. Firefox calls this SEC_ERROR_UNKNOWN_ISSUER. Two causes:
- Self-signed certificate. Common on new servers and control panels before a proper certificate is installed. Replace it with a certificate from a trusted authority — free AutoSSL, or a paid one.
- Incomplete chain. The server sends the website’s certificate but not the intermediate certificate that links it to a trusted root. Desktop Chrome often quietly fills the gap, so the site looks fine to you — while phones, apps, payment gateways and other servers refuse to connect. Reinstall the certificate with its CA bundle (cPanel: SSL/TLS → Manage SSL Sites).
The SSL checker shows the exact chain your server sends and flags a missing intermediate.
ERR_SSL_PROTOCOL_ERROR or ERR_SSL_VERSION_OR_CIPHER_MISMATCH
The browser and server couldn’t agree on how to encrypt the connection. On modern hosting this is rare and usually points to an old server configuration, a missing certificate for that domain, or a security system blocking the connection. If it only happens to some visitors or some software, read why connections get blocked — and if it’s your connection that’s blocked, find your IP and send it to support.
“Not Secure” in the Address Bar (No Full-Page Warning)
The page loaded over http://, or loaded over HTTPS but pulls in some images, scripts or fonts over http:// (“mixed content”).
Fix: redirect all http:// traffic to https:// — the SSL checker tells you whether yours does — and update old links in your content. On WordPress, our HTTPS plugin guide covers fixing mixed content.
A Quick Checklist
- Run the SSL checker on both
example.co.ukandwww.example.co.uk. - Fix anything marked Fix, starting with expiry and hostname.
- Make sure
http://redirects tohttps://. - If you’ve just changed DNS, give it time and confirm with the DNS propagation checker — AutoSSL can only issue once the domain points at the server.
- Check secure email too: choose port 993 (IMAP) or 465 (SMTP) in the SSL checker for your mail server.
Frequently Asked Questions
Is it safe to click “Proceed anyway”?
On your own site while you fix it, you know what you’re connecting to. On anyone else’s site — especially one asking for a password or payment — no.
My hosting includes free SSL. Why would the certificate expire?
Free certificates renew automatically only while the domain points at the hosting server. If DNS moved elsewhere (for example to a CDN or another host), renewal fails silently until the certificate runs out.
Do I need to buy a certificate to fix these errors?
Rarely. Most errors are fixed by renewing, adding the missing name or installing the CA bundle. A paid certificate makes sense for servers outside your hosting, wildcard coverage, or when you want a warranty and organisation validation — see how to choose the right SSL certificate.
