“Your connection is not private”: what it means and how to fix it
In short
The browser could not confirm the site's certificate: it has expired, it was issued for a different address, or it comes from an unknown issuer. If it is someone else's site, do not enter any data on it. If it is yours, the error code shown with the warning tells you what to fix: usually a new certificate or uploading the full chain is enough.
What this message means
Every time you open a website over https://, the browser checks its certificate: whether it is valid, whether it covers this address and whether it was issued by a trusted certificate authority. If any of these checks fails, the browser shows a warning instead of the page:
- Chrome: “Your connection is not private”. Edge shows a similar warning, with the same error codes.
- Firefox: “Be careful. Something doesn’t look right.” (in older versions “Warning: Potential Security Risk Ahead”).
- Safari: a warning that the connection is not private.
The warning comes with an error code, and that code tells you exactly what is wrong. In Chrome the code (e.g. NET::ERR_CERT_DATE_INVALID) is shown right below the description. In Firefox click “Advanced”: the code is at the bottom of the expanded section, after the words “Error code”.
If it is someone else's website
- Do not enter passwords, card details or personal data on it.
- Check the date and time on your computer or phone. A wrong date makes every certificate look expired or not yet valid. Chrome then shows a separate message: “Your clock is behind” or “Your clock is ahead” (how to fix the clock).
- In hotels, on trains or in cafés the warning often appears before you have signed in to the Wi-Fi network. Sign in to the network first, then open the page again.
- If the warning does not go away, let the site owner know. Usually they simply forgot to renew the certificate.
Error codes and what they mean
| Error code | What is wrong | How to fix it on your own site |
|---|---|---|
NET::ERR_CERT_DATE_INVALID(Firefox: SEC_ERROR_EXPIRED_CERTIFICATE) | the certificate has expired (or the visitor's device clock shows the wrong date) | generate a new certificate and upload it to the same place; more in the guide SSL certificate expired |
NET::ERR_CERT_COMMON_NAME_INVALID(Firefox: SSL_ERROR_BAD_CERT_DOMAIN) | the certificate was issued for a different address, e.g. only for example.com while the site opens as www.example.com, or the server shows the hosting provider's generic certificate | generate a certificate for all of the site's addresses (e.g. example.com, www.example.com) and assign it to the right domain in your panel; more in the guide SSL_ERROR_BAD_CERT_DOMAIN |
NET::ERR_CERT_AUTHORITY_INVALID(Firefox: SEC_ERROR_UNKNOWN_ISSUER or MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT) | the browser does not recognize the issuer: a self-signed certificate, a test certificate or missing intermediate certificates | upload a certificate from production mode together with the full chain: fullchain.pem, or chain.pem in the field for intermediate certificates; more in the guide NET::ERR_CERT_AUTHORITY_INVALID |
ERR_SSL_PROTOCOL_ERROR(Firefox: SSL_ERROR_RX_RECORD_TOO_LONG) | on port 443 the server answers with plain http instead of an encrypted connection. This is a different error page: Chrome says “This site can’t provide a secure connection”, Firefox “Secure Connection Failed” | enable SSL for the domain in your hosting panel; on your own server, check the configuration of port 443; more in the guides SSL protocol error and SSL_ERROR_RX_RECORD_TOO_LONG |
Missing intermediate certificates can go unnoticed in a desktop browser, because Chrome and Firefox can fill them in on their own. On some phones, in apps and in programs that connect to the site (e.g. payment gateways), the site then does not work, so always upload the full chain.
If it is your website: check which certificate the browser sees
- In Firefox, on the warning page click “Advanced”, then “View the site’s certificate” (in older versions “View Certificate”). You will see all the names (under “Subject Alt Names”), the dates (under “Validity”) and the issuer. In Chrome click the error code: the main name (“Subject”), the issuer (“Issuer”) and the expiry date (“Expires on”) appear.
- Compare the names with the site's address. If the site works both with and without www, the certificate must cover both addresses.
- Check the dates. We explain how to do this in each browser on the page How to check when a certificate expires.
- Fix the cause using the table above and upload the certificate following the guide for your hosting. You can generate a new certificate for the same addresses in the generator.
A test certificate from freessl.pl
A certificate from test mode is only for checking that your domain passes verification. Browsers do not trust it, so after you upload it they will show NET::ERR_CERT_AUTHORITY_INVALID, and you will see the word STAGING in the issuer's name. Generate the certificate again in production mode and upload it to the same place.
How to avoid this in the future
The most common cause is an expired certificate. A Let's Encrypt certificate is valid for 90 days, so it is easy to forget about it. When you save the certificate in your freessl.pl account, we send you an email reminder after two thirds of its validity and a second one a week before it ends.