Symptoms

  • A full-page warning: “Your connection is not private — NET::ERR_CERT_AUTHORITY_INVALID.”
  • It affects many HTTPS sites at once (points to clock or a proxy) or just one (points to that site’s certificate).
  • It started on a managed/work device or after installing security software.

What causes NET::ERR_CERT_AUTHORITY_INVALID

  • The device date, time or time zone is wrong, so valid certificates look expired or not-yet-valid.
  • The site uses a self-signed certificate or is missing intermediate certificates.
  • Antivirus “HTTPS scanning” or a corporate proxy is re-signing traffic with a CA your browser does not trust.
  • The certificate genuinely expired.

How to fix it

  1. Set the device date, time and time zone to automatic, then reload the page.
  2. Try the site in a private window and on a different network (e.g. mobile data); disable HTTPS/SSL scanning in your antivirus to test.
  3. If it is your own site, install the complete certificate chain (leaf plus intermediates) on the server and renew before expiry (command below checks the chain).

Terminal / CLI command

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuer

Shows the certificate’s validity dates and issuer so you can confirm expiry or a missing/unknown CA.

How to confirm the fix: The padlock shows a valid certificate and the warning no longer appears on a normal network.

Prevent it from coming back

Automate certificate renewal (e.g. ACME/Let’s Encrypt), serve the full chain, and keep device clocks synced.