Browsers show different errors depending on what's wrong with a site's certificate. Find the message you see below.
| Error | What it means | Fix |
|---|---|---|
NET::ERR_CERT_DATE_INVALID"Your connection is not private", certificate expired | The certificate has expired. | Free SSL: see Free SSL Did Not Renew. Paid SSL: check the renewal invoice is paid and the approval email was clicked (Pending Validation, Reissues and Renewals). |
NET::ERR_CERT_COMMON_NAME_INVALID"certificate is not valid for this name" | The certificate doesn't cover the address you typed. Often it covers example.com but not www.example.com (or the reverse), or a subdomain isn't included. | Make sure both versions have DNS records pointing to your hosting and re-run AutoSSL. For a paid certificate, check which names it was ordered for. |
NET::ERR_CERT_AUTHORITY_INVALID"self-signed" or "untrusted certificate" | The site is using the server's temporary self-signed certificate, or the CA bundle (chain) is missing. | Issue a free certificate (Install a Free SSL Certificate in cPanel), or reinstall your paid certificate with its CA bundle (Get the Intermediate CA Bundle). |
| "Not secure" with no error page, or no padlock | The certificate is fine, but the page loads some content over http://, or the site isn't redirecting to https://. | See Website shows "Not secure" or an SSL certificate error. |
| Cloudflare Error 526 "Invalid SSL certificate" | Cloudflare is set to Strict, and the certificate on your hosting is expired, missing or doesn't match. | Fix the certificate on your hosting first (usually re-run AutoSSL). Only switch Cloudflare to Full temporarily if you need the site up right away. See Cloudflare: SSL/TLS Settings (Crypto). |
| Cloudflare Error 525 "SSL handshake failed" | Cloudflare couldn't make a secure connection to your hosting at all. | Check the site has a certificate installed on the hosting. If it does, open a support ticket. |
ERR_TOO_MANY_REDIRECTS | Usually Cloudflare is on Flexible while your site also forces HTTPS. | Set Cloudflare's SSL mode to Full or Strict. |
ERR_CONNECTION_REFUSED or the site doesn't load on https:// | The domain doesn't point to a server that serves your site, or the hosting service was cancelled. | Check the domain's DNS and that your hosting is active. A certificate can't fix a domain that doesn't reach the site. |
| Certificate warning in your email app or when logging in to cPanel, Plesk or webmail on port 2083, 2096 or 8443 | You're connecting with your own domain (for example mail.example.com), but the server presents its own certificate. | Use the server name from your hosting welcome email as the incoming and outgoing mail server and for control panel logins. It always has a valid certificate. If the server name itself shows a warning, open a support ticket. |
| Certificate error on a link in your email campaigns (click tracking or confirm links) | The tracking subdomain (for example link.example.com) isn't set up correctly. | Check the CNAME record for your tracking link matches the value in your campaign settings, then open a support ticket so we can reissue its certificate. |
Tip: To check any site's certificate from outside, use a free online SSL checker. It shows the expiry date, the names covered and any missing chain certificates.
Still stuck?
Open a support ticket with the exact address you visited and a screenshot of the full error, including the error code.
