An SSL certificate error in Chrome — “Your connection is not private,” “NET::ERR_CERT_DATE_INVALID,” “NET::ERR_CERT_AUTHORITY_INVALID,” or similar — means Chrome has determined it can’t verify the authenticity of the site’s security certificate. This sounds like the site is dangerous, and sometimes it is. But often it’s a configuration issue on your end, and knowing which error code you’re seeing tells you which applies. For a broader walkthrough, our Google Chrome Errors is a good next read.
Before working through fixes: is this happening on one specific site, or on many sites? One site with a certificate error is almost always a real certificate problem on that site — expiry, misconfiguration, or a genuine security issue. Many sites showing certificate errors simultaneously is almost certainly something on your machine or network.
Understanding the Error Codes
The specific error code that appears below “Your connection is not private” tells you exactly what kind of certificate problem Chrome detected:
- NET::ERR_CERT_DATE_INVALID — The certificate has expired, or your system clock is wrong. Fix 1 first.
- NET::ERR_CERT_AUTHORITY_INVALID — Chrome doesn’t trust the certificate authority (CA) that signed the certificate. Could be a self-signed cert, a corporate certificate, or an antivirus inspection cert.
- NET::ERR_CERT_COMMON_NAME_INVALID — The certificate is for a different domain than the one you’re visiting. The site may have misconfigured SSL.
- ERR_SSL_VERSION_OR_CIPHER_MISMATCH — The server uses an outdated TLS version (1.0 or 1.1) or weak cipher suite that Chrome no longer accepts.
- ERR_SSL_PROTOCOL_ERROR — General TLS handshake failure; could be antivirus inspection, corrupted Chrome settings, or server configuration.
Fix 1: Check Your System Clock
This is the first thing to check for ERR_CERT_DATE_INVALID. SSL certificates have validity periods — Chrome rejects them if they’re presented outside that period. If your system clock is wrong (even a few days off), Chrome thinks certificates have expired when they haven’t, or haven’t yet become valid.
Right-click the clock in the taskbar → Adjust date and time → confirm the date and time are correct. If wrong, enable “Set time automatically” → Sync now. After syncing, refresh the failing site. Certificate errors caused by a wrong clock resolve immediately after the clock is corrected.
If you hit the equivalent problem in Mozilla’s browser, the same clock and certificate logic applies — see fixing Secure Connection Failed in Firefox for the Firefox-specific steps.
Fix 2: Clear Chrome’s SSL State
Chrome caches SSL certificate information. When a certificate changes (a site renews their certificate, or a corporate certificate is updated) and Chrome has a stale cached version, certificate errors appear even when the certificate is currently valid.
Chrome Settings → search “certificates” → click “Clear SSL state” (under Manage certificates). Or: Chrome Settings → Privacy and security → Security → Manage certificates → clear SSL state. After clearing, refresh the site. This resolves the “certificate was fine, then suddenly shows an error” pattern that follows a certificate renewal.
Also clear Chrome’s standard cache: Ctrl + Shift + Delete → Cached images and files → Clear data → restart Chrome. The SSL state and the page cache are separate — both may need clearing.
Fix 3: Antivirus HTTPS Inspection
Many security products intercept HTTPS connections to scan encrypted traffic for threats. They do this by presenting their own certificate to Chrome rather than the website’s real certificate. Chrome sees a certificate from “Avast Root CA” or “Kaspersky Anti-Virus” instead of from the site’s legitimate CA, and if Chrome doesn’t trust that CA, it shows a certificate error.
This is the most common cause of SSL errors appearing across many sites simultaneously. The fix: ensure your antivirus’s root certificate is in Chrome’s trusted root store. Most security products handle this automatically during installation — if it worked before and stopped, a software update may have reset the certificate trust.
Test: temporarily disable the HTTPS inspection component of your antivirus (not the full antivirus — specifically web filtering, SSL scanning, or HTTPS protection). If certificate errors immediately stop, the antivirus is the cause. Re-enable it and check the antivirus settings for an option to add its certificate to browsers automatically, or manually add it through Chrome’s certificate manager.
Fix 4: Corporate Network and Certificate Authority
Corporate and school networks often use their own certificate authorities to manage SSL inspection. When a new device joins the network without the corporate CA certificate installed, Chrome shows certificate errors for every HTTPS site — the corporate proxy is intercepting traffic with a certificate that Chrome doesn’t trust.
IT should handle installing the corporate CA certificate on managed devices. On a personally-owned machine connecting to a work network: ask IT for the corporate CA certificate (usually a .cer or .p7b file) and import it into Chrome’s trusted authorities: Chrome Settings → Privacy and security → Security → Manage certificates → Trusted Root Certification Authorities → Import.
Fix 5: Update Chrome
Outdated Chrome versions have outdated certificate trust stores — lists of trusted CAs maintained by Google. Sites with certificates from newer certificate authorities may show “authority invalid” errors in old Chrome versions because the CA wasn’t in the trust store when that version shipped. Update Chrome: three-dot menu → Help → About Google Chrome → install any available update → restart.
Fix 6: Windows Certificate Store
Chrome uses Windows’ certificate store for some certificate validation. When the Windows trust store has stale or incorrect root certificates, Chrome shows errors for sites that should be trusted. Update root certificates through Windows Update — run Windows Update and install all available updates, which includes certificate store updates. After updating and restarting, test the affected sites.
For machines that haven’t received Windows Updates in a long time: the certificate trust store may be significantly outdated. A root certificate update via Windows Update is the correct fix — not clicking through the certificate warning.
Proceeding Past a Certificate Warning — When It’s Safe
On the certificate error page, Chrome provides an “Advanced” option to proceed to the site anyway. This is appropriate only when you’re certain of the context: a development/testing site with a self-signed certificate, an internal corporate site with a known certificate configuration, or a router or NAS device’s admin interface.
Never proceed past a certificate error for banking, email, healthcare portals, or any site where you’re entering credentials or sensitive information. The certificate system exists specifically to protect these connections — bypassing it exposes your data to potential interception. For unknown or unexpected certificate errors on sensitive sites, investigate the cause before proceeding.
Self-Signed and Development Certificates
Self-signed certificates — created without a certificate authority, used commonly for development environments and internal tools — always produce certificate errors in Chrome because no recognised CA vouches for them. This is expected and not a security issue for known internal tools.
For development environments where you regularly encounter self-signed certificate errors: Chrome flags allow less strict certificate handling for specific localhost or development URLs. Navigate to chrome://flags/#allow-insecure-localhost → enable it to suppress certificate errors for localhost specifically. For non-localhost development sites, use a tool like mkcert (free, creates locally-trusted development certificates) to generate development certificates that Chrome trusts without warnings.
Our guide on ERR_CONNECTION_RESET covers the connection failures that sometimes accompany SSL errors when the reset happens during the TLS handshake. For corporate network-specific SSL issues requiring certificate management, our VPN troubleshooting guide covers certificate-based authentication in corporate environments. Google’s Chrome security documentation covers the chrome://net-internals/#events SSL event logging and the certificate transparency requirements that affect newer certificate types.
Certificate Pinning and HSTS
Some high-security sites use HTTP Strict Transport Security (HSTS) and certificate pinning to enforce specific security requirements. HSTS tells Chrome to always use HTTPS for a domain and refuse any HTTP connections. When a site’s certificate changes in a way that doesn’t match what Chrome’s HSTS database expects, certificate errors appear that can’t be bypassed with the “Advanced” → “Proceed anyway” option — Chrome refuses to proceed at all.
If you’re getting a certificate error you genuinely can’t bypass (no “Advanced” option appears, or the option to proceed is greyed out), HSTS pinning is likely enforced. For legitimate sites: the site’s certificate may have been compromised or misconfigured. For development sites: clear the HSTS cache. Chrome Settings → Privacy and security → Security → Manage certificates → or navigate to chrome://net-internals/#hsts → Delete domain security policies for the specific domain to remove the HSTS record and allow the connection to proceed.
Extensions Interfering With SSL
Some browser extensions — particularly VPN extensions, privacy tools, and proxy extensions — intercept HTTPS connections and may present their own certificates or modify the SSL handshake. When these extensions are active, Chrome shows certificate errors for sites that load fine without the extension.
Test: open an Incognito window (extensions are disabled by default in Incognito) and visit the failing site. If it loads without a certificate error in Incognito, an extension is interfering with the SSL connection in normal mode. Disable extensions one at a time (chrome://extensions) until the error stops, identifying the specific extension causing the SSL interception. VPN extensions and privacy-focused extensions that route traffic through their own servers are the most common culprits.
Certificate Transparency Requirement Failures
Chrome enforces Certificate Transparency (CT) — a system requiring that all publicly trusted certificates be logged in public CT logs within a time limit. Certificates issued without CT logging, or certificates whose CT logs aren’t accessible to Chrome’s verification system, fail with certificate errors. This is a server-side issue that website operators must resolve by reissuing their certificate with a CA that properly submits to CT logs.
Users can’t fix CT failures on their end — the certificate needs to be reissued by the site’s administrator with CT logging properly configured. If you’re a site administrator experiencing CT-related certificate errors for your own site, check whether your certificate was issued with Signed Certificate Timestamps (SCTs) — any modern CA should be including these automatically. Reissuing the certificate through a properly CT-compliant CA resolves the error.
Mixed Content and Partial SSL Errors
A site with a valid SSL certificate can still show security warnings if it loads non-secure (HTTP) resources — images, scripts, stylesheets — from sources that don’t use HTTPS. Chrome marks this as “mixed content” and either blocks the insecure resources or shows a warning indicator. The padlock icon turns into an information circle rather than showing a full lock.
This isn’t a certificate error but is often reported as one. The fix is on the website owner’s side — all resources need to be loaded over HTTPS. Users can’t resolve mixed content from their end, but can check which resources are mixed by opening Chrome’s DevTools (F12) → Console tab → look for “Mixed Content” warnings listing the specific HTTP resource URLs. Reporting these specific URLs to the website owner helps them fix the mixed content.
Testing Certificate Validity
When you need to confirm whether a certificate error is genuine (the site’s certificate has a real problem) or local (something on your machine is causing the error), two quick tests clarify:
- Try the same URL in Firefox — Firefox uses its own certificate store rather than Windows’. If Firefox also shows a certificate error, the certificate itself has a problem. If Firefox loads the site normally, the issue is Chrome or Windows specific.
- Use an online SSL checker (ssllabs.com/ssltest or ssl.se) — enter the domain name and the tool shows the certificate’s full validity information, expiry date, CA chain, and any issues with the certificate configuration. This definitively shows whether the certificate has problems visible from outside your network.
These two tests together distinguish between “the certificate genuinely has a problem” and “something local is misidentifying a good certificate as invalid” — the most important distinction for deciding whether to fix something locally or report an issue to the site’s administrators.
What Clicking “Advanced” Actually Does
When Chrome shows a certificate error and you click “Advanced,” you see more detail about the specific certificate problem and an option to “Proceed to [site] (unsafe).” Understanding what this action actually does is important for making an informed decision rather than reflexively clicking through.
Clicking “Proceed” tells Chrome to accept this certificate for this session despite its validation failure. Your connection to the server is still encrypted — the TLS tunnel exists. What’s not guaranteed is that you’re connected to the real server rather than an impostor. For an expired certificate on a site you know and regularly use (your router’s admin interface, a development site), the risk of impersonation is low and proceeding is reasonable. For an unexpected error on a site you’ve never seen an error on before, especially for sensitive transactions, the risk of a man-in-the-middle interception is real and proceeding is not advisable.
Chrome remembers your “Proceed anyway” decision for the session, so you don’t need to click through on every page load — but the exception expires when Chrome closes. The correct long-term solution is always fixing the underlying certificate issue rather than repeatedly clicking through. Our guide on Chrome ERR_CACHE_MISS covers an adjacent issue.
