Pillar · 31 errors
SSL & HTTPS Errors
SSL/TLS errors trigger the scary full-page browser warnings that send visitors running. They almost always come down to a certificate that is expired, misconfigured, or serving the wrong domain — fixable once you know which.
NET::ERR_CERT_DATE_INVALIDSSL Certificate Expired An expired SSL certificate triggers a full-page "Your connection is not private" warning that blocks every visitor. critical NET::ERR_CERT_AUTHORITY_INVALIDNET::ERR_CERT_AUTHORITY_INVALID The browser doesn't trust who issued the certificate — usually a missing intermediate cert or a self-signed one, not an expired one. critical NET::ERR_CERT_DATE_INVALIDNET::ERR_CERT_DATE_INVALID The certificate is outside its valid window — expired or not yet active — or the device's clock is wrong, so today falls outside the cert's dates. critical ERR_CERT_SYMANTEC_LEGACYNET::ERR_CERT_SYMANTEC_LEGACY The cert chains to a distrusted Symantec-era root, so Chrome rejects it entirely — replacing the certificate is the only fix. critical ERR_CERT_REVOKEDNET::ERR_CERT_REVOKED The issuing CA revoked this certificate before its expiry date, so the browser refuses the connection and offers no bypass. critical ERR_CERT_REVOKEDNET::ERR_CERT_REVOKED (certificate revoked by the CA) The CA has actively revoked this certificate via OCSP/CRL, so Chrome blocks it and no bypass will load the page. critical SEC_ERROR_EXPIRED_CERTIFICATESEC_ERROR_EXPIRED_CERTIFICATE (Firefox) Firefox blocks the site because the certificate's validity end date has passed, or the local clock is wrong enough to make a valid cert look expired. critical NET::ERR_CERT_COMMON_NAME_INVALIDNET::ERR_CERT_COMMON_NAME_INVALID Chrome blocks the page because the hostname you typed isn't in the certificate's Subject Alternative Name list. high ERR_SSL_VERSION_OR_CIPHER_MISMATCHERR_SSL_VERSION_OR_CIPHER_MISMATCH The TLS handshake dies because client and server share no protocol version or cipher suite in common. high SSL_ERROR_RX_RECORD_TOO_LONGSSL_ERROR_RX_RECORD_TOO_LONG in Firefox Firefox tried to start TLS on port 443 but got back plain HTTP or junk, so it aborts before any page loads. high SSL_ERROR_NO_CYPHER_OVERLAPSSL_ERROR_NO_CYPHER_OVERLAP in Firefox Firefox and the server share no cipher suite both will use, so the TLS handshake dies before any data moves. high ERR_CERT_WEAK_SIGNATURE_ALGORITHMNET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM The certificate is signed with SHA-1, a hash browsers stopped trusting, so Chrome blocks the page outright. high ERR_CERTIFICATE_TRANSPARENCY_REQUIREDNET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED Chrome blocks the cert because it can't prove the cert was publicly logged — there are no valid SCTs attached. high ERR_SSL_UNRECOGNIZED_NAME_ALERTNET::ERR_SSL_UNRECOGNIZED_NAME_ALERT The server returned a TLS unrecognized_name warning during the SNI handshake because no vhost matches the requested domain. high SEC_ERROR_OCSP_OLD_RESPONSESEC_ERROR_OCSP_OLD_RESPONSE in Firefox Firefox rejected a stapled OCSP response whose update window has already passed, so the cert's revocation status reads as stale. high MOZILLA_PKIX_ERROR_MITM_DETECTEDMOZILLA_PKIX_ERROR_MITM_DETECTED in Firefox Firefox saw a certificate signed by a root it doesn't trust and flagged the connection as intercepted by software or a proxy. high ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAINNET::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN The served certificate chain contains no public key matching a hash that was previously pinned for this host. high ERR_CERT_AUTHORITY_INVALIDNET::ERR_CERT_AUTHORITY_INVALID (untrusted / self-signed CA) Chrome can't build a trust path from the site's certificate to a root it trusts, so it blocks the page. high ERR_CERT_DATE_INVALIDNET::ERR_CERT_DATE_INVALID (expired or not-yet-valid certificate) The device clock is outside the certificate's validity window, so Chrome treats the cert as expired or not yet valid. high SEC_ERROR_UNKNOWN_ISSUERSEC_ERROR_UNKNOWN_ISSUER (Firefox: issuer not trusted) Firefox can't build a trust path to a known root CA, usually because the server skipped its intermediate certificate. high ERR_SSL_PROTOCOL_ERRORERR_SSL_PROTOCOL_ERROR Chrome connected to the server but the TLS handshake failed, usually from an outdated protocol, bad cipher match, or broken cert chain. high HSTS — no overrideHSTS Error: “You cannot visit this site right now” (no Proceed button) The domain previously sent an HSTS header, so the browser hard-blocks the cert error and strips the usual Proceed-anyway escape hatch. high SSL_ERROR_BAD_CERT_DOMAINSSL_ERROR_BAD_CERT_DOMAIN (Firefox) Firefox rejects the cert because the hostname you visited isn't listed in its Common Name or Subject Alternative Names. high ERR_SSL_KEY_USAGE_INCOMPATIBLEERR_SSL_KEY_USAGE_INCOMPATIBLE The cert's Key Usage or Extended Key Usage extensions don't permit TLS server authentication, so the browser refuses to use it. high ERR_SSL_SERVER_CERT_BAD_FORMATNET::ERR_SSL_SERVER_CERT_BAD_FORMAT Chrome received a certificate during the TLS handshake but couldn't parse it as a valid X. high ERR_BAD_SSL_CLIENT_AUTH_CERTERR_BAD_SSL_CLIENT_AUTH_CERT The server demanded a client certificate during mutual TLS and the browser presented none, an expired one, or one the server doesn't trust. high Safari — secure connectionSafari Can’t Establish a Secure Connection to the Server Safari or iOS rejected the TLS handshake, usually over an untrusted, expired, hostname-mismatched, or incomplete certificate chain. high Mixed ContentMixed Content Warning Mixed content is an HTTPS page loading some resources over insecure HTTP — it breaks the padlock and blocks assets. medium ERR_SSL_OBSOLETE_VERSIONNET::ERR_SSL_OBSOLETE_VERSION (TLS 1.0 / 1.1 deprecated) The server negotiated TLS 1. medium ERR_SSL_VERSION_INTERFERENCEERR_SSL_VERSION_INTERFERENCE (TLS 1.3 handshake interference) Something in the network path is mangling Chrome's TLS 1. medium Not Secure“Not Secure” Warning in the Address Bar The browser labels the whole site Not Secure because the page is served over plain HTTP instead of HTTPS. medium