Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Find the exact NET::ERR_CERT_* code, determine whether the failure affects one device or every visitor, then correct the certificate, hostname, chain, DNS/CDN routing, or client condition responsible. Never tell visitors to bypass the production warning.
What the warning means
Google Chrome says a full-page “Your connection is not private” interstitial indicates a problem with the site, network, or device. HTTPS is intended to protect the connection, so Chrome warns users not to enter private information on a page it marks as dangerous.
The code beneath the interstitial is the most useful diagnostic clue. Record it exactly before changing anything.
| Chrome code | What it points to | First check |
|---|---|---|
NET::ERR_CERT_COMMON_NAME_INVALID |
The certificate returned does not cover the hostname in the address bar, often because the wrong virtual host or certificate was selected. | Compare the requested hostname with the certificate subject and Subject Alternative Names (SANs); verify SNI and proxy routing. |
NET::ERR_CERT_AUTHORITY_INVALID |
The browser cannot establish trust in the certificate issuer or chain. | Install the complete intermediate chain and confirm the certificate is issued by a trusted authority. |
NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED |
The certificate does not meet Chrome’s certificate-transparency requirement. | Ask the certificate provider to reissue it correctly and deploy the replacement everywhere. |
NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM |
The certificate or its signature uses an algorithm Chrome considers too weak. | Replace it with a certificate using a currently accepted signature algorithm. |
| Other SSL certificate errors | The certificate is expired, not yet valid, incomplete, revoked, or otherwise unacceptable to the browser. | Inspect validity dates, revocation status, issuer, chain, and the certificate actually served on port 443. |
Use this safe triage order
1. Define the scope and capture evidence
Test the exact failing URL in a second browser and from a separate network. Check the apex name (for example, example.com), www, and every affected subdomain separately. Record:
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- The complete
NET::ERR_CERT_*code. - The certificate subject and SAN list.
- The issuer.
- The certificate’s “not before” and “not after” dates.
- Whether the request is going through a CDN, reverse proxy, load balancer, or directly to the origin.
This separates a public deployment fault from a single-device or single-network problem before you modify DNS or certificates.
2. Rule out a wrong clock or captive portal
If only one computer, phone, or network fails, verify that the device date, time, and time zone are correct. On hotel, airport, office, and public Wi-Fi, complete the network’s sign-in page first; a captive portal can intercept the first HTTPS request and present a certificate the browser cannot trust.
Do not use a clock correction or captive-portal explanation to dismiss failures reproduced on multiple networks. Do not ask visitors to click through a production privacy interstitial.
3. Inspect the public HTTPS endpoint
Check the DNS answer for the hostname, whether the record is proxied, and which system owns port 443. Then inspect the certificate returned for that exact hostname. A server that selects a default virtual host instead of the SNI-matched host can send a perfectly valid certificate for a different domain and still produce NET::ERR_CERT_COMMON_NAME_INVALID.
Repeat the check on every load-balanced address and CDN edge. A single node with an old, expired, or unrelated certificate can make the result appear intermittent.
4. Correct expiry, validity, or chain problems
Renew an expired certificate and deploy the replacement to every endpoint that can answer for the hostname. If the certificate is within its validity dates but Chrome reports an authority or chain error, install the complete intermediate chain supplied by the certificate authority. A leaf certificate without its required intermediates can fail even when the certificate itself is genuine.
After deployment, verify the public response again rather than relying on the control panel’s success message. Confirm that the issuer, dates, SANs, and chain now match the intended certificate.
5. Correct hostname coverage
A certificate must cover every production name that users can enter or that your redirects expose. Include the apex and www when both are live, plus API, regional, staging, or other public subdomains that terminate HTTPS.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsA wildcard covers only the names allowed by its pattern. It does not automatically cover deeper labels: a wildcard for *.example.com does not cover dev.www.example.com. Add explicit SAN coverage or use a certificate type that supports the deeper name.
6. Reconcile DNS, proxy, and origin settings
Ensure that DNS points the hostname to the intended service, the proxy status matches your architecture, and the origin is configured for the certificate expected at that layer. Changing a DNS record without changing the certificate on the newly exposed endpoint commonly creates a mismatch.
For load balancers and multi-region deployments, synchronize certificate files, private keys, intermediates, and renewal jobs. Test redirects as well as the final page, because an HTTPS redirect can fail before the destination is reached.
Cloudflare-specific checks
Cloudflare states that “SSL/TLS certificates only apply for traffic proxied through Cloudflare.” An orange-cloud hostname can therefore use a Cloudflare edge certificate, while an unproxied hostname must present a valid certificate from its own origin.
Cloudflare documents NET::ERR_CERT_COMMON_NAME_INVALID as a hostname/SNI problem and recommends confirming SNI support, proxying the hostname when appropriate, and obtaining a certificate that covers deeper subdomains when required.
Understand Universal SSL coverage
Cloudflare’s Universal SSL covers the apex and one level of subdomain. A name such as dev.www.example.com is deeper than that default coverage and requires an advanced or custom certificate, or Total TLS, according to Cloudflare’s documentation. List every public hostname and compare it with the edge certificate’s SANs before assuming the proxy covers it.
Check response-header rules and encryption mode
Cloudflare notes that conflicting Strict-Transport-Security or X-Content-Type-Options response-header rules can override SSL/TLS settings. Review Transform Rules, configuration rules, and application behavior for duplicate or contradictory headers. Remove or edit the rule that conflicts with the intended SSL/TLS configuration, then retest the redirect, final response, and subresources.
Account for older clients
Cloudflare’s page, last updated April 16, 2026, states: “Starting September 9, 2024, visitors that try to connect to your website using older devices – for example, Android 7.0 and earlier – have access problems or reach security warnings.” If your audience includes such devices, Cloudflare documents changing the certificate authority or upgrading the client as remedies. Test representative legacy devices before declaring the incident solved.
Best Value
Choose an operating model deliberately
The certificate can be managed at the origin, at a CDN edge, or through hosting-panel automation. The right choice depends on who controls DNS, proxy state, and the servers that terminate TLS.
| Consideration | Direct origin TLS | Managed CDN TLS | Hosting-panel automation |
|---|---|---|---|
| Where the public certificate is served | Origin server or load balancer | CDN edge for proxied traffic; origin still needs appropriate TLS for the selected mode | Hosting server managed by the panel |
| Automatic renewal | Depends on your ACME or certificate-operations setup; not stated for a specific provider | Provider-dependent; confirm renewal scope and notification behavior | Provider-dependent; confirm that renewal covers every hostname |
| Chain management | Your responsibility unless the platform supplies it | CDN manages its edge chain; you remain responsible for any origin chain | Panel-dependent; verify that intermediates are installed |
| Hostname depth | Determined by the certificate SANs or wildcard pattern you deploy | Determined by the edge certificate plan; Cloudflare Universal SSL covers the apex and one subdomain level | Determined by the certificate request and panel configuration |
| Failure and outage behavior | Traffic reaches the origin directly if DNS and network paths remain available | Proxy, DNS, edge-certificate, and origin-encryption failures can affect different layers | Panel, server, DNS, and renewal failures can be coupled |
| Logging and alerts | Not stated; configure monitoring for your stack | Not stated; verify edge and origin alert coverage | Not stated; verify panel renewal and expiry alerts |
| Legacy-client compatibility | Depends on your certificate chain and server software | Depends on the provider’s chain and edge compatibility; Cloudflare documents older-device issues after its September 9, 2024 chain update | Depends on the certificate authority and server configuration |
Whichever model you use, document which component terminates TLS for each hostname. That ownership map prevents a renewed origin certificate from being mistaken for a renewed CDN edge certificate.
Validate the fix without creating a new incident
- Retest the original failing URL and record the new Chrome result and certificate details.
- Test the apex,
www, every required subdomain, and any HTTP-to-HTTPS redirects. - Repeat from a second browser, a separate network, and representative client versions.
- Check every load-balanced address or CDN path, not just the endpoint that happened to respond first.
- Confirm that page subresources, API calls, and other HTTPS requests do not point to an uncovered hostname.
- Only after all intended names work should you enable or strengthen HSTS.
Prevent the warning from returning
- Automate certificate issuance and renewal, with alerts well before expiry.
- Monitor every public hostname, including redirect targets, API endpoints, mail-related web endpoints, and CDN-to-origin paths.
- Keep certificate chains and server software current.
- Keep DNS records, proxy status, load-balancer routes, and certificate SANs synchronized.
- Test modern clients and, where the audience requires it, supported legacy clients.
- Roll out HSTS only after HTTPS is correct on every hostname covered by the policy; strict browser enforcement makes an incorrect deployment harder to bypass.
A recurring mismatch usually indicates configuration drift: one hostname, certificate store, proxy setting, or load-balanced node has escaped the renewal and testing process. Treat the hostname inventory and endpoint certificate checks as one system rather than separate tasks.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
