Skip to main content

What is the ERR_CERT_AUTHORITY_INVALID error? How to fix it?

What the error means​

English: Invalid Certificate Authority / certificate not trusted, a common SSL certificate error in browsers.

When you visit an HTTPS website in a browser, the browser checks whether the certificate chain is issued by a trusted root Certificate Authority (CA). If the browser cannot establish a trusted chain between the website certificate and the locally built-in root certificate, it will throw this error.

The prompt wording varies slightly across browsers:

  • Chrome/Edge: NET::ERR_CERT_AUTHORITY_INVALID or "Your connection is not private"
  • Firefox: SEC_ERROR_UNKNOWN_ISSUER
  • Safari: "This connection is not private"

Causes​

1. Missing or incompletely configured root/intermediate certificate chain (most common)​

Only the site certificate is deployed on the server, and the intermediate certificate (certificate chain) is not deployed, so the browser cannot recognize the Certificate Authority.

2. Certificate revocation​

If a CA revokes a certificate due to reasons such as key compromise, the browser will detect the revocation status via CRL or OCSP and refuse the connection.

3. OCSP validation failure​

Some browsers enable OCSP Stapling or real-time OCSP queries. If the OCSP server is unreachable, the response times out, or the request is intercepted, the browser may throw an error because it cannot verify the certificate status.

4. Certificate vendor server failure​

When a CA's OCSP/CRL servers fail, the browser may throw an error because it cannot verify the revocation status (depending on the browser's "soft-fail" policy).

5. Outdated root certificate store on the local device​

The operating system's built-in root certificate store has not been updated for a long time and lacks the root certificate that issued the certificate, making it impossible to establish a trust chain. We recommend updating the operating system or manually importing the new root certificate.

6. Incorrect system time​

If the client system time is too far off, the browser will incorrectly judge that the certificate is "not yet valid" or "expired", resulting in an untrusted certificate error. Correcting the system time to the current time will resolve this issue.

7. Network interception/certificate tampering​

Some security software, firewalls, or man-in-the-middle devices perform SSL inspection on HTTPS traffic, replacing the original certificate with a self-signed certificate and presenting it to the browser. If that self-signed certificate is not added to the client's trust list, the browser will report this error.

Solutions​

For "incomplete certificate chain" (most common cause):

  1. Most servers (Nginx/Apache, etc.): Please directly use the .crt file in the "Nginx" folder of the certificate zip package we provided. This file already contains the site certificate and the full certificate chain, and can be configured directly.
  2. When you need to upload the certificate chain file separately: Please use the .ca-bundle file in the "Apache" folder of the zip package as the certificate chain file for upload.
  3. IIS servers: In the IIS Management Console, you need to import the intermediate certificate (already included in the pfx file) together with the site certificate and bind them correctly. Only uploading and binding the site certificate in IIS will cause this error.

For "certificate revocation":

  • Log in to the Racent console to check the certificate status. If it has been revoked, you need to apply for a new certificate or reissue it.

For "incorrect system time":

  • Sync the operating system time to internet time (Windows: Settings → Time & Language → Set time automatically).

For "outdated root certificate store":

  • Windows: Run Windows Update to install the latest root certificate updates.
  • Linux: sudo apt update && sudo apt install ca-certificates (Debian/Ubuntu) or sudo yum update ca-certificates (CentOS).
Last updated on