My SSL Certificate Is Showing as Invalid

Why Is My SSL Certificate Invalid?

When visitors see a "Your connection is not private" or "NET::ERR_CERT_INVALID" warning, it means the browser does not trust the SSL certificate on your website. This can scare visitors away and harm your credibility, so it is important to fix it quickly.

Common Causes

• Expired certificate – SSL certificates have a validity period, typically 90 days for free certificates. If it is not renewed, browsers will flag it as invalid.
• Domain name mismatch – The certificate was issued for a different domain name than the one being accessed. For example, a certificate for www.example.com will not work on example.com unless it covers both.
• Mixed content – Your page loads over HTTPS but some resources (images, scripts, stylesheets) are loaded over HTTP, causing browser warnings.
• Incomplete certificate chain – The intermediate certificate is missing, so browsers cannot verify the chain of trust back to the root authority.
• Self-signed certificate – A self-signed certificate is not trusted by browsers as it was not issued by a recognised certificate authority.

How to Fix It

1. Renew the certificate – In cPanel, go to SSL/TLS Status and click Run AutoSSL to renew your free Let's Encrypt certificate. If you have a paid certificate, renew it through your provider.
2. Check domain coverage – Ensure the certificate covers all variations of your domain including both www and non-www versions.
3. Fix mixed content – Update all internal links, image sources, and resource URLs to use https:// instead of http://. In WordPress, use a plugin like Better Search Replace to update URLs in the database.
4. Install intermediate certificates – If you installed a paid certificate manually, make sure you included the CA bundle or intermediate certificate provided by your certificate authority.
5. Test your SSL – Use SSL Labs Server Test at ssllabs.com to get a detailed report of any SSL issues and their severity.

If AutoSSL fails to issue or renew your certificate, it is usually because DNS is not pointing to the server. Ensure your domain resolves to your hosting before running AutoSSL.