NET::ERR_CERT_AUTHORITY_INVALID Error: Causes and Solution

When a browser opens an HTTPS site, it validates the SSL certificate chain: site cert → intermediate CA → root CA. If any link is untrusted or missing, Chrome shows NET::ERR_CERT_AUTHORITY_INVALID.

This doesn't mean the site is hacked. Most commonly the cause is server administration:

• Self-signed certificate (not issued by a public CA)
• Root CA not installed in the OS
• Incomplete certificate chain on server (missing intermediate CA)
• Expired root CA (rare, happens with legacy certificates)
• Certificate from an untrusted CA (example: COMODO, no longer in chrome root store)

1. Check your SSL certificate online — use the Enterno.io SSL checker. Enter your domain to see the full chain, issuer and any issues.
2. If the certificate is self-signed — replace with Let's Encrypt (free) or a commercial CA.
3. If the chain is incomplete — add the intermediate CA to your bundle. For nginx: ssl_certificate /path/to/fullchain.pem; (not just cert.pem).
4. Check Root CA in browser — Chrome uses its own trust store, not the system one. Update Chrome.
5. Clear browser SSL cache — Chrome: chrome://net-internals/#ssl → Flush sockets.

Check SSL certificate →

The NET::ERR_CERT_AUTHORITY_INVALID error occurs when a browser cannot verify the SSL certificate's authority. To fix this, ensure your SSL certificate is issued by a trusted Certificate Authority (CA), correctly installed, and configured. Check your server settings and consider using tools like openssl s_client -connect yourdomain.com:443 to diagnose the certificate chain.

The NET::ERR_CERT_AUTHORITY_INVALID error indicates that the SSL certificate presented by your website is not trusted by the browser. This can occur for various reasons, including self-signed certificates, expired certificates, or certificates issued by an unrecognized authority. Understanding the underlying causes is crucial for effectively resolving this issue.

Common Causes of the Error

• Self-Signed Certificates: Certificates that are generated and signed by yourself rather than a trusted CA.
• Expired Certificates: SSL certificates have a validity period, typically ranging from 90 days to 2 years. Once this period expires, the certificate becomes invalid.
• Unrecognized Certificate Authorities: If the SSL certificate is issued by a CA that is not included in the browser's trusted root certificate store, the browser will flag it as invalid.
• Misconfigured SSL/TLS Settings: Incorrect server configuration can lead to improper certificate installation, resulting in trust issues.

Step-by-Step Fix for NET::ERR_CERT_AUTHORITY_INVALID

To resolve the NET::ERR_CERT_AUTHORITY_INVALID error, follow these steps:

1. Verify the SSL Certificate: Use the following command to check the SSL certificate details:

openssl s_client -connect yourdomain.com:443 -showcerts

This command will display the certificate chain. Ensure that the certificate is issued by a trusted CA and that the entire chain is correctly presented.

1. Check Certificate Expiry: Ensure that your SSL certificate is still valid. You can verify the expiration date in the output from the previous command or use an online SSL checker.
2. Update the Certificate: If your certificate is expired, you need to renew it through your CA. Follow their specific instructions to generate a Certificate Signing Request (CSR) and obtain a new certificate.
3. Install the Certificate Properly: Ensure the SSL certificate is installed correctly on your server. If you are using Apache, your configuration might look like this:

SSLEngine on
SSLCertificateFile /path/to/your_certificate.crt
SSLCertificateKeyFile /path/to/your_private.key
SSLCertificateChainFile /path/to/ca_bundle.crt

Make sure to restart your web server after making changes.

1. Check CA Trust: If you are using a less common CA, ensure that it is included in the trusted root authorities of the browser. You can check the list of trusted CAs in your browser settings or through the operating system’s certificate management tool.
2. Clear Browser Cache: Sometimes, cached data can lead to persistent errors. Clear your browser's cache and cookies to ensure that you are loading the most recent version of the site.
3. Consider Using Let’s Encrypt: If you need a free and trusted SSL certificate, consider using Let’s Encrypt, which is recognized by all major browsers. Their certificates are valid for 90 days but can be auto-renewed.

Testing After Fixing

After implementing the above steps, retest your website using the openssl command or online SSL testing tools like SSL Labs. Confirm that there are no warnings or errors regarding the certificate status.

Best Practices for SSL Management

• Regularly Monitor SSL Certificates: Use tools or scripts to check for certificate expiration dates and ensure timely renewals.
• Implement HTTP Strict Transport Security (HSTS): This helps enforce secure connections to your server.
• Educate Users: Inform users about potential warnings they might encounter due to certificate issues and guide them on how to report these problems.