NET::ERR_CERT_AUTHORITY_INVALID: the browser does not trust the certificate issuer

Updated October 2026 · about 4 min read

In short

The browser cannot confirm who issued the site's certificate. Most often it is a self-signed certificate (the default certificate of the server or panel), a test certificate, or a missing intermediate certificate on the server. The site owner fixes it with a certificate from a trusted issuer, installed with the full chain. Firefox shows the same problem as SEC_ERROR_UNKNOWN_ISSUER.

What the browser shows and what it means

A website certificate is issued by a certificate authority, and the browser has a list of authorities it trusts. When it cannot link the certificate to any of them, it shows a warning instead of the site:

Chrome shows “Your connection is not private” with the code NET::ERR_CERT_AUTHORITY_INVALID. After you click “Advanced” it says: “This server could not prove that it is example.com; its security certificate is not trusted by your computer’s operating system.” Edge shows a similar warning with the same code.
Firefox shows “Be careful. Something doesn’t look right.” After you click “Advanced”, under “What makes the site look dangerous?”, it lists three possibilities: it can’t tell who issued the certificate, the certificate is self-signed, or the site isn’t sending intermediate certificates. The code is further down, after “Error Code”: SEC_ERROR_UNKNOWN_ISSUER or, for a self-signed certificate, MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT.

Both browsers add that the cause may be a misconfiguration or someone intercepting the connection. For a site you know that worked yesterday, it is usually the server configuration, but while the warning is showing, don’t enter any data on it.

If it is someone else’s site

Don’t enter passwords, card details or personal data, and don’t bypass the warning.
If you see this error on many sites at once, the cause is usually on your side: antivirus software that inspects https connections, a proxy server on a corporate network, or public Wi-Fi before you log in. Firefox suggests asking your IT team or configuring the antivirus software. Open the site on another network, e.g. on your phone using mobile data.
Very old devices don’t know newer certificate authorities. Let’s Encrypt works, for example, on Android 7.1.1 and later. On an older phone the warning may affect only your device.
If the site doesn’t work on any network or device, let its owner know.

The most common causes on your site

Cause	How to recognise it	How to fix it
self-signed certificate	the issuer field shows the same name as the subject field (often the name of the server or panel); Firefox: `MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT`	it is usually the default certificate that the server or panel creates on installation; replace it with a certificate from a trusted issuer
test certificate	the issuer name contains the word STAGING	generate the certificate again in production mode and upload it to the same place
missing intermediate certificate	in Chrome on a computer the site often works, but phones, apps and Firefox show an error; Firefox: `SEC_ERROR_UNKNOWN_ISSUER`	install the full chain: the whole `fullchain.pem`, or `chain.pem` in the intermediate certificate field
a certificate from an issuer browsers don’t know	the issuer is e.g. a company’s internal certificate authority or an unknown name	on a public site, use a certificate from a public certificate authority, such as a free Let’s Encrypt one

A missing intermediate certificate is easy to overlook, because Chrome on a computer can fetch it on its own. Payment gateways, apps and some phones don’t, so for them the site simply doesn’t work.

How to find out which cause it is

Enter the site’s address in the “Check a certificate” tool. It recognises a test certificate, a self-signed one, one from an unknown issuer and a missing intermediate certificate.
In Firefox, click “Advanced” on the warning page and then “View the site’s certificate”. You will see the issuer and every certificate the server sent.
On a computer with a terminal (Linux, macOS, Git Bash on Windows):
```
echo | openssl s_client -connect yourdomain.com:443 \
  -servername yourdomain.com 2>/dev/null \
  | grep "Verify return code"
```
The result 21 (unable to verify the first certificate) means a missing intermediate certificate, 18 (self-signed certificate) a self-signed certificate, and 19 (self-signed certificate in certificate chain) an issuer outside the trusted list. A correct certificate gives 0 (ok).

How to fix it on your site

In the generator, get a production certificate for all of the site’s addresses, e.g. example.com, www.example.com.
Upload it following the guide for your hosting. If the panel has one field for the certificate, paste the whole fullchain.pem. If it has a separate field for the intermediate certificate (e.g. “CA”, “chain”), paste chain.pem there.
Check in the panel that the new certificate is assigned to the domain your site runs on, not just added to the list.
On your own server, point to the file with the full chain: in nginx ssl_certificate, in Apache SSLCertificateFile, in both cases fullchain.pem. Test the configuration (sudo nginx -t or sudo apachectl configtest) and reload the server. The full installation is described in the server guide.
Check the site again in the “Check a certificate” tool or with the openssl command above, then in a private window and on a phone.