NET::ERR_CERT_AUTHORITY_INVALID: How to Fix It in Chrome and Edge

During the TLS handshake the server sends its own (leaf) certificate and, if configured correctly, the intermediate CA certificates. Chrome's verifier then tries to build a path from the leaf, through intermediates, to a root in the Chrome Root Store or to a root that an administrator installed in the operating system. When no such path exists, because the issuer is unknown, the root is not trusted or a signature does not verify, Chrome reports NET::ERR_CERT_AUTHORITY_INVALID (net error -202). Chromium describes it as a certificate "signed by an authority we don't trust" in net_error_list.h.

This is a trust failure in certificate validation, at the TLS layer. It is not a DNS problem, not a protocol or cipher mismatch and not, by itself, a sign that the site was hacked. Chrome shows one code per certificate, and an untrusted issuer outranks a wrong hostname or an expired date, so an expired self-signed certificate still produces this code rather than ERR_CERT_DATE_INVALID.

Missing intermediate. If the server sends only the leaf, desktop Chrome often still succeeds: its verifier downloads the missing issuer from the URL in the certificate's Authority Information Access (AIA) extension. Firefox does not fetch issuers that way; it relies on a preloaded set of intermediates from public CAs. Tools such as curl, Python, Java and Go do neither by default, so an incomplete chain often looks fine in a browser and fails in scripts and apps (see CERTIFICATE_VERIFY_FAILED in Python). When AIA fetching is blocked or the certificate has no AIA URL, Chrome shows this error too.

Interception. Corporate TLS inspection, antivirus "HTTPS scanning" and some parental-control tools re-sign every site with their own root. Chrome trusts that root only if it is installed in the OS certificate store. On a new device, or after the product was removed without cleaning up, every HTTPS site fails with this code, and the certificate viewer names the product instead of the real CA.

Distrusted CA. A CA can be removed from the Chrome Root Store; Chrome stopped trusting newly issued Entrust certificates in late 2024. Certificates from such a CA fail even with a perfect chain.

The browser judges the certificate on the first TLS hop. With a CDN in front, that is the edge certificate; the origin certificate matters only to the CDN.

• Cloudflare Origin CA certificate exposed. Origin CA certificates are trusted only by Cloudflare. If you pause Cloudflare or switch a record to DNS only, browsers reach the origin directly and show NET::ERR_CERT_AUTHORITY_INVALID. Turn the proxy back on or install a publicly trusted certificate on the origin.
• Untrusted origin under Full (strict). Cloudflare does not pass this to the browser; it answers with error 526. In Full mode it does not validate the origin certificate at all.
• Incomplete chain on nginx, HAProxy or Apache. The server must send the leaf plus every intermediate up to (not including) the root.

# nginx: fullchain.pem = leaf + intermediates
ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

# HAProxy: one PEM file with the chain and the key
# cat fullchain.pem privkey.pem > /etc/haproxy/certs/example.com.pem
bind :443 ssl crt /etc/haproxy/certs/example.com.pem

On Apache 2.4.8 and later, point SSLCertificateFile at fullchain.pem; SSLCertificateChainFile is deprecated.

1. See exactly what the server sends:

   openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null

   One certificate whose issuer is not a root means a missing intermediate; OpenSSL prints verify error:num=20:unable to get local issuer certificate followed by num=21:unable to verify the first certificate. num=18:self-signed certificate means subject and issuer are identical.
2. Fix the chain: use fullchain.pem from certbot, or append your CA's intermediate bundle after the leaf, then run sudo nginx -t && sudo systemctl reload nginx.
3. Replace self-signed or private-CA certificates on public hostnames with a publicly trusted one, for example sudo certbot --nginx -d example.com -d www.example.com. Walkthrough: free Let's Encrypt setup.
4. Test every node and address family. One load-balancer node or the IPv6 address may still serve an old bundle: openssl s_client -connect 203.0.113.10:443 -servername example.com for each IP.
5. If you run an internal CA, deploy its root to every client through your device management; browsers outside that fleet will keep showing the error.

• One site fails, others work: the problem is the site. Nothing on your side repairs a missing chain or an untrusted CA; tell the owner.
• Every HTTPS site fails: open the certificate viewer from the "Not secure" label and read the issuer. An antivirus or company name means interception: turn off HTTPS or encrypted-connection scanning in the antivirus, or ask IT to install their root certificate.
• Only on one network: hotel and public Wi-Fi login pages and some filtering proxies intercept HTTPS. Try mobile data, or finish the Wi-Fi login first.
• Bypassing: Advanced, then "Proceed to example.com (unsafe)" exists, but not on HSTS sites, and it hides a possible attacker. Use it only on servers you control.

Clearing the cache or cookies does not help: certificates are not served from the HTTP cache, they are checked on every new connection.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | grep "Verify return code"
# → Verify return code: 0 (ok)

curl -sS -o /dev/null -w "%{http_code}\n" https://example.com/
# any HTTP status means the chain verified; a chain problem prints curl: (60)

Test with curl, not only Chrome: AIA fetching can hide a missing intermediate in the browser. To see the chain your server sends from outside your network, run the enterno.io SSL checker.

• SEC_ERROR_UNKNOWN_ISSUER (Firefox counterpart)
• MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT
• NET::ERR_CERT_COMMON_NAME_INVALID
• NET::ERR_CERT_DATE_INVALID
• MOZILLA_PKIX_ERROR_MITM_DETECTED
• Incomplete certificate chain