This means the browser can't trace your certificate back to a trusted root — almost always because the intermediate certificate bundle wasn't installed alongside your certificate.
The fix
Install (or reinstall) the CA's intermediate bundle alongside your certificate in your server's SSL configuration. Verify with openssl s_client -showcerts against your live server to confirm the full chain, not just your own certificate, is actually being presented.
What this error specifically indicates about the certificate's issuer
This error means the certificate was issued by a CA your browser or system doesn't recognize as trusted — commonly a self-signed certificate, an internal/private CA not installed in your trust store, or in rarer cases, a genuinely malicious certificate attempting impersonation.
How to distinguish an expected internal certificate from a genuine security concern
If you're accessing internal company infrastructure or a development environment where a private CA is expected, this error is normal and expected, resolved by installing that specific CA into your trust store — but on a public, unfamiliar website, this same error deserves genuine caution rather than being dismissed.
What to do if you specifically expected this error, like on an internal tool
For an internal company tool or development environment where a private CA is genuinely expected, installing that specific CA's root certificate into your system or browser trust store, following your organization's documented process, resolves the warning permanently for that specific, legitimate internal infrastructure.
What to do if you didn't expect this error on a site you believe should be publicly trusted
If a site you expect to have a normal, publicly trusted certificate shows this error, checking the certificate's actual issuer field reveals whether it's genuinely self-signed or from an unfamiliar CA — worth reporting to the site owner directly, since this likely reflects a misconfiguration on their end rather than anything fixable from your side.
How this error connects to the broader concept of certificate authorities covered elsewhere on this site
Understanding this error deeply requires understanding what a certificate authority actually is and why trust flows from a curated root list, concepts covered in depth in our Basics category's certificate authority and chain of trust articles — this error is essentially that trust model's practical, visible enforcement point.
A final note on distinguishing expected from unexpected instances
Keeping a clear internal record of which internal tools and environments are expected to show this warning, and why, helps your team distinguish an expected, already-understood internal certificate scenario from a genuinely new and possibly concerning instance of the same error appearing somewhere unexpected.
What the specific technical difference is between a self-signed and an untrusted-CA certificate
A self-signed certificate is signed by its own private key with no separate CA involved at all; an untrusted-CA certificate is genuinely issued by a real certificate authority, just one your specific browser or system doesn't currently trust — both trigger this identical error, but they represent meaningfully different underlying scenarios.
How enterprise environments commonly and legitimately use this exact configuration
Many corporate environments deliberately deploy an internal CA specifically for internal tools and services never meant to be publicly accessible — seeing this error on an internal company tool is expected and normal, resolved simply by installing your organization's specific internal CA certificate into your trust store.
A quick closing checklist
A quick closing checklist covers checking the certificate's issuer field, determining whether this is expected internal infrastructure or an unfamiliar public site, and installing the specific CA only when you have genuine, verified reason to trust it.
Why company IT departments should communicate clearly about expected internal certificate warnings
Providing employees clear, upfront guidance about which specific internal tools will show this warning, and confirming it's expected, prevents unnecessary support tickets and the more concerning habit of employees learning to click through warnings reflexively without evaluating each one.