ERR_CERT_SYMANTEC_LEGACY: Legacy Certificate

• Certificate issued by Symantec/VeriSign/Thawte/GeoTrust before 2017-12-01
• RapidSSL/SSL.com cert bought before 2018
• Legacy corporate cert not rotated in 5+ years
• Equifax Secure Certificate Authority (outdated sub-CA)
• Old EV certs from Symantec brands

1. Reissue via DigiCert (Symantec's successor) — free replacement for legacy customers
2. Or move to Let's Encrypt: certbot --nginx -d example.com
3. Check the CA: openssl x509 -in cert.pem -issuer — look for "Symantec"/"VeriSign"
4. Update fullchain on the server after the new cert is issued
5. Verify with SSL Checker — see CA and issue date

Check SSL Certificate →

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    ssl_stapling        on;
    ssl_stapling_verify on;
}

• NET::ERR_CERT_AUTHORITY_INVALID
• ERR_CERT_DATE_INVALID
• ERR_SSL_PROTOCOL_ERROR
• SSL Handshake Failed
• All SSL errors

The ERR_CERT_SYMANTEC_LEGACY error indicates that a website's SSL certificate is issued by an outdated Symantec certificate authority, which is no longer trusted by modern browsers. To resolve this issue, website administrators must replace the legacy certificate with a certificate from a trusted authority, such as Let's Encrypt or DigiCert, and ensure proper configuration to avoid future errors.

The ERR_CERT_SYMANTEC_LEGACY error is commonly encountered when a web browser detects that the SSL certificate used by a website is issued by a legacy Symantec Certificate Authority (CA). This error originated from a significant incident in 2017 when major browsers, including Google Chrome and Mozilla Firefox, decided to distrust certificates issued by Symantec due to various security concerns and misissuances. As a result, any site still using these certificates will trigger security warnings for users.

As of 2026, all Symantec legacy certificates will be completely deprecated, making it crucial for web administrators to transition to more reliable and recognized CAs. Failure to do so not only risks losing user trust but also impacts site accessibility, as browsers will block access to sites with untrusted certificates.

The transition away from Symantec certificates is governed by the CA/Browser Forum guidelines, which stipulate that all certificates must be issued by trusted authorities. The primary alternatives include:

• Let's Encrypt: A free, automated, and open CA that provides SSL certificates.
• DigiCert: A widely recognized commercial CA known for its robust security features.
• GlobalSign: Another reputable CA that offers a range of SSL options.

To avoid ERR_CERT_SYMANTEC_LEGACY errors, it is essential to regularly audit your SSL certificates and ensure they are issued by a current and trusted CA.

Resolving the ERR_CERT_SYMANTEC_LEGACY error involves several steps, primarily focused on replacing the outdated SSL certificate with a valid one from a trusted CA. Below is a step-by-step guide to help you through this process:

1. Identify the Current Certificate: Use the following command to check the certificate details currently in use:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com

This command will return details about the SSL certificate, including the issuer. Look for any mention of Symantec in the issuer's name.

1. Obtain a New SSL Certificate: Choose a trusted CA and follow their process to obtain a new SSL certificate. For instance, if you opt for Let's Encrypt, you can use Certbot to automate the process:

sudo apt-get install certbot python3-certbot-nginx

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

This command automatically configures your NGINX server to use the new certificate.

1. Update Server Configuration: After obtaining the new certificate, ensure that your web server is configured to use it. For NGINX, you would typically update your server block configuration as follows:

server {
    listen 443 ssl;
    server_name yourdomain.com www.yourdomain.com;
    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
}

Make sure to replace the paths with the actual paths to your SSL certificate files.

1. Test the Configuration: After updating the configuration, restart your web server:

sudo systemctl restart nginx

Then, test your website using a browser or tools like SSL Labs to ensure the new certificate is recognized and there are no errors.

1. Monitor for Future Issues: Regularly check your SSL certificate status and expiration dates to prevent any future occurrences of ERR_CERT_SYMANTEC_LEGACY or related errors.

By following these steps, you can effectively resolve the ERR_CERT_SYMANTEC_LEGACY error and maintain a secure browsing experience for your users.