Your connection is not private: what it means and how to fix it

Kofi Agyem, Founder and CEO, CloudzyroPublished November 1, 2026 · 5 min read

On this page

1. The short answer
2. What you'll see
3. What each code means
4. Fixes for visitors, quickest first
5. Fixes for site owners
6. How to check
7. Sources

Your connection is not private means a site's HTTPS certificate failed a check. What each NET::ERR_CERT code means and how visitors and owners fix it.

1. The short answer

Your connection is not private means the browser reached the site, but the site's HTTPS certificate failed a check. The certificate might not come from a trusted authority, might be for a different name, or might be expired. The browser can't confirm it's talking to the real site, so it stops before sending anything.

The code under the message tells you which check failed. On your side, the usual fixes are your clock, public Wi-Fi sign-in pages and antivirus. If it happens on every network and device, the site's owner needs to fix the certificate.

2. What you'll see

Chrome: Your connection is not private. Attackers might be trying to steal your information from example.com. With a code such as NET::ERR_CERT_AUTHORITY_INVALID.
Edge: Your connection isn't private, with the same codes.
Firefox: Warning: Potential Security Risk Ahead, with codes like SEC_ERROR_UNKNOWN_ISSUER, SSL_ERROR_BAD_CERT_DOMAIN or SEC_ERROR_EXPIRED_CERTIFICATE.
Safari: This Connection Is Not Private. This website may be impersonating example.com.

3. What each code means

NET::ERR_CERT_AUTHORITY_INVALID: the certificate doesn't chain to an authority your device trusts. Self-signed certificates, a missing intermediate certificate, an old device that lacks a current root, or software that intercepts HTTPS (antivirus, company proxies, captive portals).
NET::ERR_CERT_COMMON_NAME_INVALID: the certificate doesn't list the name you opened. Browsers check the certificate's Subject Alternative Names, so a certificate for example.com doesn't cover www.example.com unless it lists both.
NET::ERR_CERT_DATE_INVALID: the certificate has expired or isn't valid yet, or your clock is wrong. See ERR_CERT_DATE_INVALID.
NET::ERR_CERT_REVOKED: the authority withdrew the certificate, for example because its key leaked.
NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM: the certificate is signed with an outdated algorithm such as SHA-1.
NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED: the certificate wasn't logged publicly, which Chrome requires for publicly trusted certificates.

If the browser can't set up HTTPS at all, you get a different page, This site can't provide a secure connection: see ERR_SSL_PROTOCOL_ERROR and SSL handshake failed.

4. Fixes for visitors, quickest first

Reload, and check you typed the address correctly.
Check your date and time are set automatically. A wrong clock breaks certificate checks for every site.
On public Wi-Fi, open http://neverssl.com or any plain http:// address to trigger the sign-in page, sign in, then try again.
Try an incognito window and another network, such as mobile data.
Turn off antivirus HTTPS scanning or your VPN briefly. If that fixes it, the software is replacing certificates; update it or change its settings.
Update your browser and operating system, which brings current trusted root certificates.
If it still appears everywhere, don't proceed on a site where you'd sign in or pay. Tell the owner.

Seeing this on many sites at once, including big ones like Google, almost always means something on your device or network: the clock, antivirus, a company proxy, or the Wi-Fi.

5. Fixes for site owners

See what your server sends with openssl s_client (below): the names, dates and chain.
Cover every name. Include both www.example.com and example.com if visitors use both, or redirect one to the other with a certificate that covers both. See www vs non-www.
Serve the full chain. Configure the server with the full chain file (Let's Encrypt calls it fullchain.pem), not just your own certificate. Some browsers fill in a missing intermediate themselves, so the site can look fine in one browser and fail in another or in curl.
Use a public authority, not a self-signed certificate, for anything public.
Automate renewal with an ACME client such as certbot, or a host that does it for you.
Check CAA records. If your domain has any, they must allow the authority that issues your certificates, or it can't issue them.
Check DNS points at the right server. A domain pointed at a server that doesn't host it gets that server's default certificate and a name mismatch.

On Cloudzyro Sites & Apps, certificates are issued and renewed automatically once your domain's DNS points at us: www (or a subdomain) as a CNAME to domains.cloudzyro.app, the bare domain as an A record to 173.234.137.167. If your domain has CAA records, they must allow letsencrypt.org, pki.goog and ssl.com. At Cloudflare, set the records to DNS only (gray cloud). Wait until the site's Domains tab says Live before testing; the custom domain docs and the domain troubleshooting guide cover each step.

6. How to check

# Show the certificate chain your server sends
openssl s_client -connect www.example.com:443 -servername www.example.com -showcerts

# Just the names, issuer and dates of the server's certificate
openssl s_client -connect www.example.com:443 -servername www.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

# curl checks the certificate like a strict client
curl -vI https://www.example.com/

# Any CAA records?
dig +short CAA example.com

Look for Verify return code: 0 (ok) from openssl. unable to get local issuer certificate means a missing intermediate or an untrusted issuer. If the subjectAltName list doesn't include the name you opened, that's ERR_CERT_COMMON_NAME_INVALID. notAfter in the past is an expired certificate. In Chrome, you can also click the icon left of the address and open the certificate details.

7. Sources

Questions

What does Your connection is not private mean?

The browser connected to the site, but the site's HTTPS certificate failed a check: it isn't trusted, doesn't match the address, or is out of date. The browser stops so you don't send anything to a site it can't confirm.

Is it safe to proceed anyway?

Not on a site where you'd sign in, pay or type anything private. Someone could be intercepting the connection. Only proceed on a device or site you control, such as your own router's settings page.

Why is there no option to proceed?

The site uses HSTS, which tells browsers to require a valid certificate every time. On those sites the browser won't let you click through, by design.

Why do I only see it on public Wi-Fi?

Many hotel, airport and cafe networks intercept your first connection to show a sign-in page. Open a plain http:// address to bring up the sign-in page, sign in, then try the site again.

What does NET::ERR_CERT_AUTHORITY_INVALID mean?

The certificate wasn't issued by an authority your device trusts. It may be self-signed, missing an intermediate certificate, or replaced by antivirus or a company network that inspects traffic.

What does NET::ERR_CERT_COMMON_NAME_INVALID mean?

The certificate is valid but for a different name. For example, it covers example.com but you opened www.example.com, or the domain points at a server that holds another site's certificate.

How do I fix it as a site owner?

Use a certificate from a public authority that covers every name visitors use, serve the full chain, and renew it automatically. Check with openssl s_client to see exactly what your server sends.