Visitors see a security warning

Visitors are seeing a security warning instead of your site. This page routes you from the browser's error code to the specific SSL issue.

Symptom

• Visitors see a full-page browser warning instead of your site (e.g. "Your connection is not private", "This site can't provide a secure connection")
• The padlock icon is missing from the address bar
• A browser-specific error code is shown: NET::ERR_CERT_* in Chrome/Edge, SSL_ERROR_* or MOZILLA_PKIX_* in Firefox, error numbers in Safari

What it means

Browsers show full-page warnings when they don't trust a site's SSL certificate. The warning is deliberately alarming, because the browser is protecting visitors from a potentially compromised connection, and most people won't click past it to reach you. There are several distinct reasons this happens, and the browser error code tells you which one applies.

Possible underlying issues

Match the browser's error code to one of these:

Browser error	Underlying problem	Page
NET::ERR_CERT_DATE_INVALID (expiry in past)	Expired	Certificate expired
NET::ERR_CERT_DATE_INVALID (start in future)	Not yet valid	Certificate not yet valid
NET::ERR_CERT_COMMON_NAME_INVALID	Wrong hostname	Hostname doesn't match certificate
NET::ERR_CERT_AUTHORITY_INVALID (self-signed)	Self-signed	Self-signed certificate
NET::ERR_CERT_AUTHORITY_INVALID (with intermediates)	Untrusted chain	Certificate signed by an untrusted authority
NET::ERR_CERT_REVOKED	Revoked	Certificate has been revoked
NET::ERR_CERT_INVALID (signature)	Invalid signature	Certificate signature is invalid
SSL_ERROR_HANDSHAKE_FAILURE or no cert presented	Handshake failed	TLS handshake failed

How to identify which issue you have

1. Open DomainDash and look at the affected site's Security card. It gives the reason in plain English, which tells you which issue you have.

2. If you can't check DomainDash, run this from any terminal:

   openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issuer

   Look at the dates first (expired? not yet valid?), then the subject (does it cover your domain?), then the issuer (is it a recognised CA?).

3. Open the site in an incognito Chrome window. Click "Not secure" in the address bar, then "Certificate is not valid". The reason shown is the underlying issue.

How to verify

After applying the fix from the specific issue page:

1. Open the site in an incognito window. The padlock should appear with no warnings.
2. Open the site in DomainDash. The next scheduled SSL check (every 6 to 24 hours, depending on your plan) marks the certificate Valid and clears the Security problem or Security expired badge. If the problem had also taken the site Down, DomainDash re-checks the certificate as soon as the site recovers, so the badge clears within minutes.

Related

• SSL certificates — overview of what DomainDash checks
• How incidents work — how DomainDash confirms and notifies about SSL issues