Browser SSL errors are specific for a reason — the code tells you exactly what failed, if you know how to read it.
- NET::ERR_CERT_DATE_INVALID — the certificate is expired, or not yet valid. Check expiry and server clock.
- NET::ERR_CERT_COMMON_NAME_INVALID — the certificate doesn't cover the exact hostname requested (often a www / non-www mismatch).
- NET::ERR_CERT_AUTHORITY_INVALID — the chain of trust is broken, usually a missing intermediate certificate.
- SSL_ERROR_NO_CYPHER_OVERLAP — the server only supports encryption methods the browser has disabled as insecure; update the server's TLS configuration.
- ERR_SSL_PROTOCOL_ERROR — often a misconfigured server sending plain HTTP on the HTTPS port, or a corrupted certificate file.
When in doubt, run the domain through an SSL checker tool — it will identify the specific chain and configuration issue directly rather than requiring you to reproduce the browser error.
More error codes worth recognizing
- ERR_CERT_REVOKED — the certificate has been explicitly revoked by its CA, typically due to a suspected key compromise. Never click through this one.
- ERR_SSL_VERSION_OR_CIPHER_MISMATCH — client and server share no common protocol version or cipher suite; one side needs updating.
- ERR_CONNECTION_REFUSED (port 443) — nothing is listening on the HTTPS port at all; this is a server or firewall issue, not a certificate one.
- NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM — the certificate was signed using a deprecated algorithm like SHA-1 and needs reissuing.
Why reading the exact code matters more than the general warning text
Browsers group many distinct underlying problems under similarly alarming-looking warning screens, but the specific error code, visible by clicking 'Advanced' or similar, points to one precise, well-documented cause. Troubleshooting based on the specific code rather than the general warning saves considerable guesswork.
A quick decision path for any SSL error you encounter
First, identify the specific code. Second, check whether it's a certificate-content issue (date, hostname, chain) or a connection-level issue (refused, protocol mismatch, timeout) — these two categories point toward entirely different troubleshooting paths, covered in dedicated depth throughout this Troubleshooting category. Third, if you're the site owner, run an SSL scan tool for a complete diagnostic picture rather than only reacting to what one specific browser reports.