How to Fix SSL Certificate Errors

TL;DR: Most SSL certificate errors fall into four categories — expired certificate, untrusted issuer, hostname mismatch, and mixed content. Each has a distinct browser error code and a specific fix. This guide covers all of them. Run a free Kalenfy scan to check your certificate status, expiry date and HTTPS configuration without opening DevTools.

SSL error quick-reference

Fix 1 — Expired certificate (NET::ERR_CERT_DATE_INVALID)

This is the most common SSL error. Your certificate has a fixed validity period (typically 90 days for Let's Encrypt, up to 397 days for paid CAs). When it expires, browsers block the site entirely.

How to renew

• Let's Encrypt / Certbot: sudo certbot renew. If auto-renewal is set up (cron or systemd timer), it runs automatically 30 days before expiry. Check with sudo certbot renew --dry-run.
• cPanel / hosting panel: SSL/TLS → Install and Manage SSL → AutoSSL → Run AutoSSL. Most shared hosts auto-renew.
• Cloudflare: If your site is proxied through Cloudflare, they issue and renew the edge certificate automatically — no action needed.
• Paid certificate: Log into your CA's portal and re-issue. You'll need to generate a new CSR if the CA doesn't support renewal in place.

Prevent future expiry: Set a calendar reminder 30 days before expiry, or use a monitoring tool. The Kalenfy scanner shows expiry dates in the free report.

Fix 2 — Untrusted or self-signed certificate (ERR_CERT_AUTHORITY_INVALID)

Browsers maintain a built-in list of trusted Certificate Authorities (CAs). If your certificate was issued by a CA not on that list — or if you issued a self-signed cert — browsers show this error.

Causes and fixes

• Self-signed certificate: Replace it with one from a trusted CA. Let's Encrypt is free and takes minutes to set up.
• Missing intermediate certificate: Your CA gave you a certificate but you didn't install the full chain (root → intermediate → leaf). Download the intermediate bundle from your CA and add it to your server config:

  # Apache
  SSLCertificateChainFile /etc/ssl/certs/ca-bundle.crt
  
  # nginx
  ssl_certificate /etc/ssl/certs/yourdomain_chain.crt;

• CA root not trusted on old OS: Some old Android and Windows devices don't have newer CA roots. Let's Encrypt had this issue when IdenTrust cross-signed root expired in 2021. Solution: use a cert from a CA with broad root trust (DigiCert, Sectigo) or add the CA root to the device trust store.

Fix 3 — Hostname mismatch (NET::ERR_CERT_COMMON_NAME_INVALID)

The certificate is valid but was issued for a different domain name. Common causes:

• Certificate covers yourdomain.com but the visitor accessed www.yourdomain.com (or vice versa)
• You installed a certificate for the wrong domain
• Your server has multiple virtual hosts and is serving the wrong certificate

Fixes

• www vs non-www: Issue a certificate that covers both yourdomain.com and www.yourdomain.com. With Certbot: certbot --domains yourdomain.com,www.yourdomain.com. Most paid CAs include www in the SAN automatically.
• Wildcard certificate: *.yourdomain.com covers all subdomains but not the root domain — issue a SAN cert covering both *.yourdomain.com and yourdomain.com.
• Wrong virtual host serving: Check your web server's SNI config (Server Name Indication). Nginx: verify server_name directives match the certificate's SAN. Apache: verify ServerName and ServerAlias.

Fix 4 — HTTP served on HTTPS port (SSL_ERROR_RX_RECORD_TOO_LONG)

This error means your server is sending an unencrypted HTTP response on port 443 — the port browsers expect to use for TLS. The browser tries to start a TLS handshake but gets a plain HTTP response, which is too long for a TLS record header.

Fix: check your web server config. The HTTPS virtual host must use SSL/TLS:

# nginx — verify this block exists for port 443
server {
    listen 443 ssl;
    ssl_certificate /etc/ssl/certs/yourdomain.crt;
    ssl_certificate_key /etc/ssl/private/yourdomain.key;
    ...
}

# Apache — verify mod_ssl is loaded and VirtualHost uses SSL
<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/yourdomain.crt
    SSLCertificateKeyFile /etc/ssl/private/yourdomain.key
    ...
</VirtualHost>

Fix 5 — TLS protocol / cipher mismatch

ERR_SSL_PROTOCOL_ERROR or ERR_SSL_VERSION_OR_CIPHER_MISMATCH appear when the browser and server cannot agree on a TLS version or cipher suite.

• Server too old: Enable TLS 1.2 and TLS 1.3 minimum. Disable SSLv2, SSLv3, TLS 1.0 and TLS 1.1 (deprecated). Nginx example: ssl_protocols TLSv1.2 TLSv1.3;
• Client too old: Windows XP / very old Android don't support modern TLS. If you must support them, add TLS 1.0 back — but weigh the security trade-off. Most sites should not do this.
• Misconfigured cipher list: Use Mozilla's SSL Configuration Generator for a copy-paste config appropriate to your server.

How to check your certificate without a browser

# Check certificate expiry and details
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com < /dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issuer

# Verify the full chain
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com -showcerts < /dev/null

# Check certificate from an external tool
curl -vI https://yourdomain.com 2>&1 | grep -E 'SSL|subject|expire'

FAQ

My certificate shows as valid in the browser but the Kalenfy scan flags it — why?

Kalenfy checks the certificate directly from the server (not via CDN cache). If you use Cloudflare, the browser sees Cloudflare's certificate, but the origin certificate between Cloudflare and your server may be self-signed or expired. Fix: in Cloudflare SSL/TLS → Overview, set to Full (strict) and ensure a valid certificate is installed on your origin server.

How long does it take for a new SSL certificate to propagate?

Certificate installation takes effect immediately on the server — there's no DNS propagation delay. However, if you're behind a CDN or load balancer, you may need to deploy the new cert to each edge node, which can take minutes.

Do I need an SSL certificate for a site that doesn't take payments?

Yes. HTTPS is required for all sites: it protects session cookies, prevents injection of ads or malware by ISPs, is a Google ranking signal, and is required by browsers to enable modern APIs (geolocation, service workers, push notifications). Let's Encrypt makes it free with no excuse not to.