View Plans
Help

How to fix “Your connection is not private”

“Your connection is not private” means the browser could not verify the site’s SSL certificate, so it stopped before loading the page. Usually the certificate has expired, covers another name, or is not trusted. Visitors should check their device clock and network. Site owners fix it by issuing a valid certificate, for example with AutoSSL in cPanel.

Updated · HostUpIndia team

What “Your connection is not private” means

Before a page loads over https://, the browser checks the site’s SSL certificate: that it is in date, issued for the name in the address bar, and signed by an authority the browser trusts. If a check fails, it stops and shows this warning.

Chrome says “Your connection is not private”, Edge “Your connection isn’t private”, Firefox “Warning: Potential Security Risk Ahead” and Safari “This Connection Is Not Private”. The error code under the message names the check that failed. In Firefox, select Advanced to see it.

  • NET::ERR_CERT_DATE_INVALID: the certificate has expired, or the device’s clock is wrong. In Firefox: SEC_ERROR_EXPIRED_CERTIFICATE.
  • NET::ERR_CERT_COMMON_NAME_INVALID: the certificate is for another name, such as example.com without www, or the server’s shared default certificate. In Firefox: SSL_ERROR_BAD_CERT_DOMAIN.
  • NET::ERR_CERT_AUTHORITY_INVALID: the browser does not trust whoever signed the certificate. It is self-signed, the server leaves out the intermediate certificate, or antivirus or network software is intercepting the connection. In Firefox: SEC_ERROR_UNKNOWN_ISSUER or MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT.
  • ERR_SSL_PROTOCOL_ERROR is a different error: the secure connection could not be set up at all. See how to fix ERR_SSL_PROTOCOL_ERROR.

If you are visiting the site

Most of these warnings come from the website. A few come from your own device or network, so rule those out first.

Do not continue past the warning on a site where you log in, pay or enter personal details. Choosing Advanced, then Proceed (unsafe) in Chrome or Accept the Risk and Continue in Firefox, sends your data over a connection the browser could not verify. Sites that use HSTS do not offer this option.

  • Set your device’s date, time and time zone to update automatically, then reload. A wrong clock makes every certificate look expired. Chrome may say “Your clock is behind” or “Your clock is ahead”.
  • On public Wi-Fi, such as in a hotel, airport or café, complete the network’s sign-in page first. Until you do, the network can intercept secure sites.
  • Try another network, such as mobile data. If the site loads there, the first network is the cause.
  • Pause any antivirus feature that scans secure connections, often called HTTPS scanning, and try again. Turn it back on afterward.
  • Update your browser and operating system. Older devices may not trust newer certificates.
  • Try the address with or without www.
  • If the warning shows on every device and network, the site’s certificate is at fault. Let the site owner know and try again later.

If it is your website

A warning on every device and network means the fix is on the server. Find out what the server sends before you change anything.

  • Open https://example.com and https://www.example.com, and note the error code for each.
  • View the certificate. In Chrome, select Not secure in the address bar, then Certificate is not valid. In Firefox, select Advanced, then View Certificate.
  • Note who it was issued to, the names it covers and its expiry date.
  • Look up both names with a DNS lookup tool, or run dig example.com A and dig www.example.com A in a terminal.
  • Compare the result with the hosting IP address in your welcome email or client area. If it differs, fix DNS first: how to connect a domain to your hosting.
  • Check for an AAAA record too. One that points to an old server sends some visitors there.
  • If the domain runs through Cloudflare or another CDN, visitors get the CDN’s certificate. Check its SSL/TLS settings and certificate status there.

Fix the “common name invalid” error

NET::ERR_CERT_COMMON_NAME_INVALID means the certificate does not list the name in the address bar. Browsers check the certificate’s Subject Alternative Name list, not the older common name field.

The usual causes: the certificate covers example.com but not www.example.com, or the domain has no certificate yet and the server sends its shared default certificate, issued to the server’s own name. After a move or a DNS change, this lasts until DNS points to your hosting and a new certificate is issued.

  • Point both the domain and www to your hosting.
  • Wait until a DNS lookup returns your hosting IP address for both names.
  • In cPanel, open Domains and check that the domain is listed. Add it if it is not.
  • Open SSL/TLS Status.
  • If example.com or www.example.com shows as excluded, select it, then select Include Domains During AutoSSL.
  • Select Run AutoSSL and wait for it to finish. This can take several minutes.
  • Check each name’s status. If one failed because it resolves to another IP address, fix its DNS record and run AutoSSL again.
  • Open both names in a private window and check that the warning is gone.

Fix an expired or untrusted certificate

NET::ERR_CERT_DATE_INVALID on every device means the certificate has expired. AutoSSL renews its own certificates before they expire, so an expired one means renewal failed or the certificate came from elsewhere.

NET::ERR_CERT_AUTHORITY_INVALID means the certificate is self-signed, or the server does not send the intermediate certificate that links it to a trusted authority.

  • In cPanel’s SSL/TLS Status, check each name’s expiry date and any error shown next to it.
  • Make sure the domain still points to your hosting. AutoSSL cannot renew a name that resolves elsewhere.
  • Check that no firewall, security plugin or .htaccess rule blocks /.well-known/. AutoSSL checks files there to confirm you control the domain.
  • Select Run AutoSSL. It replaces expired and self-signed certificates.
  • Installing a certificate you bought? In cPanel, open SSL/TLS, then Manage SSL sites.
  • Paste the certificate and select Autofill by Certificate.
  • Check that the Certificate Authority Bundle field is filled. Without it, some browsers and phones cannot trust the certificate.
  • Select Install Certificate, then test the site with an SSL checker that reports the full chain.
  • If the page loads and only the address bar shows a warning, the cause is mixed content: images or scripts loaded over http://. That is a different fix: change those links to https://.

HostUpIndia Web & cPanel Hosting

HostUpIndia Web & cPanel Hosting includes free SSL and cPanel for the steps above. Plans also include LiteSpeed, NVMe storage, terminal (SSH) access, the AI Website Builder and daily backups kept 30 days.

Plans start at ₹49 a month on 3-year billing. Prices exclude 18% GST. See Web & cPanel plans.