"Your connection is not private": what causes it and how to fix it on your site
The warning means the browser could not verify your site's TLS certificate. The error code under it tells you which check failed. Here is each one, what usually causes it, and the fix.
What the warning means
Before a browser sends anything over HTTPS, it checks the certificate the server presents: that it was issued by a trusted certificate authority, that it covers the hostname in the address bar, that it is within its validity dates and that it has not been revoked. If any of these checks fails, Chrome and Edge show "Your connection is not private", Safari shows "This Connection Is Not Private" and Firefox shows "Warning: Potential Security Risk Ahead".
For visitors the advice is simple: do not enter passwords or card details on a page that shows this. For the site owner it is an outage. Most visitors leave, and sites that use HSTS cannot be clicked through at all.
What each error code means
Click "Advanced" on the warning page to see the code. It points to the cause:
| Chrome / Edge code | Firefox code | What failed | Usual cause |
|---|---|---|---|
NET::ERR_CERT_DATE_INVALID | SEC_ERROR_EXPIRED_CERTIFICATE | Validity dates | The certificate expired, or the visitor's clock is wrong |
NET::ERR_CERT_COMMON_NAME_INVALID | SSL_ERROR_BAD_CERT_DOMAIN | Hostname match | The certificate does not list this hostname, for example www is missing |
NET::ERR_CERT_AUTHORITY_INVALID | SEC_ERROR_UNKNOWN_ISSUER | Trust chain | Self-signed certificate, private CA, or a missing intermediate certificate |
NET::ERR_CERT_REVOKED | SEC_ERROR_REVOKED_CERTIFICATE | Revocation | The CA revoked the certificate, often after a key compromise or mis-issuance |
Run the hostname through the SSL checker to see the same checks from outside your network: expiry date, the names the certificate covers, every certificate in the chain and the revocation status.
Fix: the certificate has expired
This is the most common cause. Renew the certificate with your CA or hosting provider, install it on every server, load balancer and CDN that serves the hostname, and reload the web server. The SSL certificate renewal guide covers each step and the usual reasons an automatic renewal fails.
Fix: the name does not match
The certificate has to list the exact hostname in its Subject Alternative Names. A certificate for example.com does not cover www.example.com, and a wildcard *.example.com covers www.example.com but not example.com itself or a.b.example.com.
- Reissue the certificate with every hostname you serve, including both the bare domain and
www. - Check that DNS points at the server you think it does. A hostname that still points at an old host shows that host's certificate.
- On shared hosting and CDNs, make sure the custom domain was added to the account; otherwise the provider serves its default certificate.
Fix: the certificate is not trusted
A self-signed certificate, or one from your company's internal CA, is never trusted by public browsers. Replace it with a certificate from a public CA. Let's Encrypt, ZeroSSL and Google Trust Services issue them free.
If the certificate is from a public CA, the server is probably not sending the intermediate certificate. Some browsers fetch the missing intermediate themselves, so the site works for you and fails for other browsers, phones and API clients. Install the full chain file your CA provides (often called fullchain.pem) rather than the certificate alone.
echo | openssl s_client -connect example.com:443 -servername example.com -showcerts 2>/dev/null | grep -E '^ *[0-9] s:|i:'When it is the visitor's device, not your site
If the SSL checker shows a valid certificate and only some people see the warning, the cause is on their side:
- Wrong date and time on the device, which makes a valid certificate look expired or not yet valid.
- Public or hotel Wi-Fi that intercepts HTTPS to show a sign-in page.
- Antivirus or corporate proxies that inspect HTTPS with their own certificate, which the browser does not trust.
- Old devices that lack a current root certificate.
How to stop it happening again
- Automate renewal through ACME or your hosting provider. With certificate lifetimes dropping to 47 days by 2029 (see the 47-day certificate guide), manual renewal stops being practical.
- Check every hostname, not just the main site. The bulk SSL expiry checker checks up to 20 at once.
- Monitor the certificate that is actually served, so a renewal that was issued but never deployed is caught before it expires.
Frequently asked questions
How do I fix "Your connection is not private" on my website?
Read the error code under Advanced, then fix the certificate it points to: renew it if it expired, reissue it with the right hostnames if the name does not match, or install the full chain if it is not trusted. Check the result with an SSL checker from outside your network.
Why does Google Chrome keep telling me my connection is not private?
If it happens on one site, that site's certificate has a problem. If it happens on many sites, check your device's date and time, then any antivirus HTTPS scanning, VPN or public Wi-Fi sign-in page, which are the usual causes on the visitor's side.
Why does my iPhone say "This Connection Is Not Private"?
Safari shows this when it cannot verify the site's certificate. If it appears on one site only, the site's certificate is at fault. If it appears everywhere, check Settings > General > Date & Time and turn on Set Automatically, and try another network.
Is it safe to click "Proceed anyway"?
Not on a site where you enter a password or payment details. The warning means the browser cannot confirm who it is talking to, so the connection may be intercepted. On your own test server with a self-signed certificate it is fine.
Does an expired SSL certificate affect SEO?
Indirectly, yes. Search engines do not demote a page for one expired day, but visitors bounce at the warning, links and API clients fail, and a long outage can lead crawlers to drop pages they cannot fetch over HTTPS.