Browser SSL errors are specific for a reason — the code tells you exactly what failed, if you know how to read it.
- NET::ERR_CERT_DATE_INVALID — the certificate is expired, or not yet valid. Check expiry and server clock.
- NET::ERR_CERT_COMMON_NAME_INVALID — the certificate doesn't cover the exact hostname requested (often a www / non-www mismatch).
- NET::ERR_CERT_AUTHORITY_INVALID — the chain of trust is broken, usually a missing intermediate certificate.
- SSL_ERROR_NO_CYPHER_OVERLAP — the server only supports encryption methods the browser has disabled as insecure; update the server's TLS configuration.
- ERR_SSL_PROTOCOL_ERROR — often a misconfigured server sending plain HTTP on the HTTPS port, or a corrupted certificate file.
When in doubt, run the domain through an SSL checker tool — it will identify the specific chain and configuration issue rather than requiring you to reproduce the browser error.
More error codes worth recognizing
- ERR_CERT_REVOKED — the certificate has been explicitly revoked by its CA, typically due to a suspected key compromise. Never click through this one.
- ERR_SSL_VERSION_OR_CIPHER_MISMATCH — client and server share no common protocol version or cipher suite; one side needs updating.
- ERR_CONNECTION_REFUSED (port 443) — nothing is listening on the HTTPS port at all; this is a server or firewall issue, not a certificate one.
- NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM — the certificate was signed using a deprecated algorithm like SHA-1 and needs reissuing.
Why reading the exact code matters more than the general warning text
Browsers group many distinct underlying problems under similarly alarming-looking warning screens, but the specific error code, visible by clicking 'Advanced' or similar, points to one precise, well-documented cause. Troubleshooting based on the specific code rather than the general warning saves considerable guesswork.
A quick decision path for any SSL error you encounter
First, identify the specific code. Second, check whether it's a certificate-content issue (date, hostname, chain) or a connection-level issue (refused, protocol mismatch, timeout) — these two categories point toward entirely different troubleshooting paths, covered in dedicated depth throughout this Troubleshooting category. Third, if you're the site owner, run an SSL scan tool for a complete diagnostic picture rather than only reacting to what one specific browser reports.
Why the exact same underlying problem shows different codes in different browsers
Chrome, Firefox, and Safari each implement their own certificate validation logic on top of the same underlying TLS protocol, which is why the identical misconfiguration can surface as NET::ERR_CERT_AUTHORITY_INVALID in Chrome and a differently-worded "Warning: Potential Security Risk" in Firefox. The specific code matters less than the category it falls into — a hostname mismatch, a chain problem, a revocation, or a in practice expired certificate are the four buckets nearly every browser error ultimately maps back to, regardless of which browser's specific wording you're looking at.
What "expand advanced" actually reveals in each browser
Every major browser deliberately hides the specific error code behind an extra click — Chrome's "Advanced," Firefox's "Advanced... Accept the Risk," Safari's "Show Details" — rather than showing it by default, since the specific code is meaningful to a developer troubleshooting the issue but not to a typical visitor. Getting in the habit of clicking through to that specific code, rather than only reading the generic top-level warning, is what actually turns a vague "something's wrong" into an actionable diagnosis.
Building a personal reference for the codes you see most often
If you manage more than one site, keeping a short personal note mapping the handful of error codes you've actually encountered to their real causes and fixes saves considerably more time than re-diagnosing the same recurring issue from scratch each time it resurfaces on a different property.
Loading comments…