SSL certificate or HTTPS problem: diagnosis and fix
An SSL problem shows up as a full-screen browser warning ("Your connection is not private", NET::ERR_CERT_DATE_INVALID, NET::ERR_CERT_AUTHORITY_INVALID), a crossed-out padlock, or resources that refuse to load. Visitors leave, APIs refuse to talk to each other and modern browsers simply block access.
The most common causes are an expired certificate, an automatic Let's Encrypt renewal that failed silently, an incomplete certificate chain, a certificate that does not cover the domain name in use (www or subdomain) or mixed content, meaning resources loaded over HTTP inside an HTTPS page.
This page helps you read the exact error message, check your certificate with the right tools, fix the server configuration and set up reliable renewal so the problem does not come back.
Typical symptoms
- "Your connection is not private" warning with a NET::ERR_CERT_DATE_INVALID, NET::ERR_CERT_AUTHORITY_INVALID or NET::ERR_CERT_COMMON_NAME_INVALID code.
- The padlock is crossed out or the browser shows "Not secure" although the page is on HTTPS.
- The site works without www but not with www, or the other way round, or a subdomain returns a certificate error.
- Some images, stylesheets or scripts do not load and the browser console reports "Mixed Content".
- An API client, a mobile app or a curl script returns "certificate verify failed" or "unable to get local issuer certificate".
- The site works on recent browsers but not on older devices, or the other way round.
Possible causes
Expired certificate
Let's Encrypt certificates last three months, commercial certificates one year. Without working automatic renewal or a reminder, expiry goes unnoticed until visitors see the warning.
Failed Let's Encrypt renewal
Port 80 is blocked, the .well-known/acme-challenge file is intercepted by a redirect or an .htaccess rule, the DNS record has changed, the certbot service or systemd timer is disabled, or Let's Encrypt rate limits were hit.
Incomplete certificate chain
The server sends the site certificate without the intermediate certificates. Desktop browsers often compensate, but mobiles, older devices and API clients fail.
Domain name not covered
The certificate was issued for example.com but not for www.example.com, or for a forgotten subdomain. A multi-domain (SAN) or wildcard certificate is needed.
Mixed content
http:// URLs hard-coded in the content, the theme, CSS files or the CMS settings (WordPress siteurl, PrestaShop PS_SHOP_DOMAIN_SSL) after switching to HTTPS.
Server or proxy configuration
Wrong certificate file in Nginx or Apache, default vhost served for the domain, CDN or reverse proxy (Cloudflare, load balancer) with an incompatible SSL mode, obsolete TLS protocols disabled on the client side.
Wrong system clock
A server or client machine with the wrong date treats a valid certificate as not yet valid or expired.
Checks to perform
- 1
Read the exact error
Click the padlock or "Advanced" in the browser warning: the error code tells you whether the issue is the date (DATE_INVALID), the authority (AUTHORITY_INVALID, incomplete chain or self-signed certificate) or the name (COMMON_NAME_INVALID).
- 2
Analyse the certificate from the outside
The SSL Labs test (ssllabs.com/ssltest) gives a full report: validity, chain, covered names, protocols. On the command line: openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -dates -subject -issuer.
- 3
Check the chain
In the openssl s_client output, the "Certificate chain" section must contain the site certificate followed by one or more intermediates. "Verify return code: 21 (unable to verify the first certificate)" signals an incomplete chain.
- 4
Test the renewal
certbot certificates lists certificates and their expiry dates; certbot renew --dry-run simulates the renewal and shows the exact error (port 80 unreachable, challenge not found, DNS). systemctl list-timers shows whether the certbot timer is active.
- 5
Spot mixed content
Open the browser console (F12): "Mixed Content" messages list every resource loaded over HTTP. A scanner such as Why No Padlock does the same job for a given URL.
- 6
Check the server configuration
In Nginx: ssl_certificate must point to fullchain.pem (not cert.pem); nginx -t validates the syntax. In Apache: SSLCertificateFile and SSLCertificateChainFile or a combined file; apachectl configtest validates.
- 7
Check the server date
date and timedatectl status must show the correct time and active NTP synchronisation.
Solutions
Renew or reissue the certificate
certbot renew (or certbot --nginx / --apache for a new issuance) after fixing the cause of the failure, or renewal with the commercial authority followed by installation of the new certificate.
Restore automatic renewal
Re-enable the certbot systemd timer or cron job, allow port 80 and the .well-known/acme-challenge path, or switch to DNS validation (DNS-01) if port 80 cannot be opened.
Install the full chain
Use fullchain.pem with Let's Encrypt, or concatenate the certificate and the intermediates provided by the authority, then reload the web server.
Cover every name
Reissue the certificate with all required domains and subdomains (multiple -d options in certbot) or use a wildcard certificate via DNS validation.
Eliminate mixed content
Fix URLs in the database (wp search-replace for WordPress, PrestaShop SSL settings), in the theme and CSS files, then add the Content-Security-Policy: upgrade-insecure-requests header as a safety net.
Fix the proxy or CDN configuration
Align the CDN SSL mode (Full strict on Cloudflare with a valid certificate at the origin), configure certificates on the load balancer, enforce the HTTP to HTTPS redirect in a single place.
When should you call a professional?
- The site is in production and shows a full-screen warning to every visitor.
- certbot renew --dry-run fails and the error message means nothing to you.
- The infrastructure includes a load balancer, a CDN, a reverse proxy or several servers and you do not know where the certificate is installed.
- Mobile apps or API partners refuse to connect because of the certificate.
- You want reliable automatic renewal and expiry monitoring in place.
How Agencei can help
- 1
Diagnosis
Analysis of the certificate, chain, covered names and TLS configuration from the outside and on the server, identification of the exact cause of the error.
- 2
Immediate fix
Certificate renewal or reissue, full chain installation, Nginx, Apache, proxy or CDN configuration fix, service reload.
- 3
Mixed content clean-up
URL fixes in the database, theme and files, redirects and security headers put in place.
- 4
Renewal automation
certbot or ACME client configuration with HTTP or DNS validation, service reload hooks, dry-run test.
- 5
Monitoring
Certificate expiry alert and regular validity checks from the outside.
Frequently asked questions
Why did my Let's Encrypt certificate not renew?
The most frequent reasons are a blocked port 80, a redirect preventing access to .well-known/acme-challenge, a DNS or server change, or a disabled certbot timer. certbot renew --dry-run shows the precise cause.
The site is on HTTPS but the padlock is still crossed out, why?
It is almost always mixed content: an image, a script or a stylesheet is loaded over HTTP. The browser console lists the resources concerned.
Do I need a paid certificate?
For the vast majority of sites, no: Let's Encrypt provides certificates trusted by every browser. Paid certificates bring a contractual warranty, extended validation or a one-year lifetime, useful in some corporate contexts.
The certificate works on desktop but not on mobile, how is that possible?
Usually because of an incomplete chain: desktop browsers sometimes fetch the missing intermediate, mobiles and API clients do not. Serving fullchain.pem fixes it.
How long does it take to fix an SSL problem?
A renewal or a missing chain is often fixed in under an hour. Mixed content on a large site or an infrastructure with a CDN and load balancer can take longer.
Related services
Security
Hacked site cleanup, hardening, vulnerability assessment, WAF, backups and access management.
See this serviceIT Support
Application and server support, incident handling and clear service commitments.
See this serviceDevOps Consulting
Setting up CI/CD, infrastructure as code, monitoring and GitOps practices.
See this serviceIT Maintenance
Monitoring, updates, backups and continuous improvement of your applications in production.
See this serviceTell us about your project
Describe your need in a few lines: we come back to you with a first analysis and the next steps.