ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN: Fix

• Site changed its SSL cert while the old HPKP pin is still valid
• Chrome static pin (built into the browser) does not match
• Corporate proxy with MITM cert not in the pin list
• Client was MITMed on a previous visit
• Broken HPKP header on the server (max-age too large)

1. Open chrome://net-internals/#hsts → Delete domain → enter your domain
2. Clear TLS state: chrome://net-internals/#sockets → Flush sockets
3. Remove HPKP from the server (deprecated since 2018): Public-Key-Pins: max-age=0;
4. For static pins (e.g. google.com, facebook.com) — only a Chrome update
5. Inspect the cert chain via SSL Checker to see the current chain

Check SSL Certificate →

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    ssl_stapling        on;
    ssl_stapling_verify on;
}

• NET::ERR_CERT_AUTHORITY_INVALID
• ERR_CERT_DATE_INVALID
• ERR_SSL_PROTOCOL_ERROR
• SSL Handshake Failed
• All SSL errors