NET::ERR_CERT_AUTHORITY_INVALID
Networking
Medium severity
“Your Connection Is Not Private” — NET::ERR_CERT_AUTHORITY_INVALID
The site’s TLS certificate isn’t trusted — a wrong system clock, a self-signed or expired certificate, or a corporate/AV proxy intercepting HTTPS.
Last reviewed 2026-08-29 by the Tech Issue Guide team.
Symptoms
- A full-page warning: “Your connection is not private — NET::ERR_CERT_AUTHORITY_INVALID.”
- It affects many HTTPS sites at once (points to clock or a proxy) or just one (points to that site’s certificate).
- It started on a managed/work device or after installing security software.
What causes NET::ERR_CERT_AUTHORITY_INVALID
- The device date, time or time zone is wrong, so valid certificates look expired or not-yet-valid.
- The site uses a self-signed certificate or is missing intermediate certificates.
- Antivirus “HTTPS scanning” or a corporate proxy is re-signing traffic with a CA your browser does not trust.
- The certificate genuinely expired.
How to fix it — 3 steps
- Set the device date, time and time zone to automatic, then reload the page.
- Try the site in a private window and on a different network (e.g. mobile data); disable HTTPS/SSL scanning in your antivirus to test.
- If it is your own site, install the complete certificate chain (leaf plus intermediates) on the server and renew before expiry (command below checks the chain).
Terminal / CLI command
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuerShows the certificate’s validity dates and issuer so you can confirm expiry or a missing/unknown CA.
How to confirm the fix: The padlock shows a valid certificate and the warning no longer appears on a normal network.
Prevent it from coming back
Automate certificate renewal (e.g. ACME/Let’s Encrypt), serve the full chain, and keep device clocks synced.
Frequently asked questions
Is it safe to click ‘Proceed anyway’?
Only if you understand exactly why the warning appears (e.g. your own test server with a self-signed cert). On a normal public site, treat it as a real risk and do not proceed.
Every HTTPS site shows this on my work laptop — why?
Your employer likely runs an SSL-inspection proxy whose CA should be installed by IT. If it is missing, contact IT; do not disable security to work around it.