Applies to: HTTPS websites, mail servers and control panels with SSL/TLS certificates
Browsers and apps show “certificate not trusted”, “Your connection is not private” or “NET::ERR_CERT_...” when they can’t confirm the certificate. We tested the common causes with OpenSSL against deliberately broken test sites; the error code in brackets is what OpenSSL reports.
Find the cause
openssl s_client -connect example.com:443 -servername example.com -verify_hostname example.com </dev/null | grep "Verify return code"
Verify return code: 0 (ok) means the certificate is fine. Otherwise:
- Expired (
10 (certificate has expired)): renew it. Let’s Encrypt and cPanel AutoSSL renew automatically when the domain still points to the server. - Self-signed (
18 (self-signed certificate)) or unknown root (19 (self-signed certificate in certificate chain)): replace it with a certificate from a trusted authority, for example a free Let’s Encrypt certificate. - Wrong name (
62 (hostname mismatch)): the certificate doesn’t include the name you visited, oftenwwwversus the bare domain. Issue it for both names. - Missing intermediate (
21 (unable to verify the first certificate)): the server sends only your certificate, not the chain. Some browsers still work, but phones, apps and other servers fail. Install the CA bundle with the certificate.
Check the dates and names
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -subject -ext subjectAltName
Other causes
- The computer’s clock is wrong: certificates look expired or not yet valid.
- Antivirus or company firewalls that inspect HTTPS replace certificates with their own.
- Mixed content: the certificate is fine, but the page loads images or scripts over
http://, so the browser shows a warning.
cPanel servers: connection untrusted error in cPanel/WHM. Converting certificates for Windows: convert a certificate to PFX. Need a certificate? See our SSL certificates.
