How to Fix SSL Errors in Chrome/Firefox/Safari

1. Identify the error type. Chrome: NET::ERR_CERT_AUTHORITY_INVALID = untrusted CA. ERR_CERT_DATE_INVALID = expired. ERR_CERT_COMMON_NAME_INVALID = wrong domain. ERR_SSL_PROTOCOL_ERROR = TLS incompatibility.
2. Diagnose with the SSL checker. Open /en/ssl, enter the domain. Get the full certificate chain, expiry, issuer, grade.
3. Reissue the certificate. For Let's Encrypt: certbot --nginx -d example.com. For a commercial CA — via the registrar's panel.
4. Configure fullchain. nginx: ssl_certificate /path/fullchain.pem; (not just cert.pem). Apache: SSLCertificateFile + SSLCertificateChainFile.
5. Update TLS versions. Enable TLS 1.2 and 1.3, disable 1.0/1.1 (deprecated in Chrome 90+).
6. Recheck. Return to the SSL checker — the grade should be A or A+.
7. Set up monitoring. Enable SSL monitoring — get a 14-day expiry alert ahead of time.

Open tool →

Before diving into fixing browser SSL errors, it’s crucial to understand the different types of SSL certificates available. This knowledge can help you choose the right certificate and resolve issues effectively.

There are mainly three types of SSL certificates:

• Domain Validated (DV): These certificates provide basic encryption and are issued quickly, often within minutes. They confirm ownership of the domain but do not verify the identity of the organization.
• Organization Validated (OV): OV certificates require a more thorough validation process. They not only encrypt data but also verify the organization’s identity, providing a higher level of trust.
• Extended Validation (EV): EV certificates offer the highest level of trust, displaying the organization's name in the browser’s address bar. They require extensive validation, making them suitable for e-commerce sites and businesses handling sensitive information.

To avoid SSL errors, ensure you choose the right type of certificate for your needs and keep its validity period in mind. An expired or misconfigured certificate can lead to browser warnings and errors.

SSL errors can arise from various sources. Identifying the underlying cause is essential to apply the correct fix. Here are some common causes of SSL errors:

• Expired SSL Certificate: If your SSL certificate has expired, browsers will display a warning. Regularly monitor your certificate’s expiration date and renew it in advance.
• Incorrect Domain Name: If the SSL certificate is issued for a different domain (or subdomain), browsers will flag it as untrusted. Ensure that the domain name matches exactly.
• Mixed Content Issues: When a secure page (HTTPS) loads resources over an insecure connection (HTTP), it can trigger SSL errors. Always ensure all resources are served over HTTPS.
• Server Configuration Issues: Misconfigurations in the web server, such as incorrect TLS versions or cipher suites, can lead to SSL errors. Regularly review your server settings.

By understanding these common causes, you can more effectively troubleshoot and resolve SSL errors as they arise.

When troubleshooting SSL errors, using specific commands can help diagnose and fix issues quickly. Here are some practical commands:

• Check SSL Certificate with OpenSSL: Use the following command to check the SSL certificate details:

This command establishes a connection to your server and retrieves the SSL certificate details. Look for expiration dates and the certificate chain.

• Renewing a Let's Encrypt Certificate: If you’re using Certbot with Let's Encrypt, you can renew your certificate with:

Make sure to run this command regularly or set up a cron job for automatic renewal.

• Testing TLS Versions: To check supported TLS versions, you can use:

This command will list the supported TLS versions and cipher suites on your server, helping you identify any security issues.

By utilizing these commands, you can efficiently troubleshoot and resolve SSL errors, ensuring a secure browsing experience for your users.