NET::ERR_CERT_AUTHORITY_INVALID means the browser could not trace the website's certificate back to a certificate authority (CA) it trusts. The certificate may be self-signed, issued by a private CA, missing its intermediate chain, or replaced on the way by software or a network that intercepts HTTPS.
Before you start
- Open the certificate viewer in Chrome and look at Issued by.
- Test from another device and network.
Common causes
- Self-signed certificate – the server's default certificate, or one you generated yourself.
- Missing intermediate certificate (incomplete chain), common with manually installed paid certificates; some browsers fill the gap, others fail.
- A Cloudflare origin certificate viewed directly without the Cloudflare proxy.
- Antivirus, company proxy or public Wi-Fi intercepting HTTPS with its own certificate.
- Outdated device without current root certificates.
How to fix it as the site owner
- Check the issuer. If it says the server hostname or your own name, it is self-signed. Run cPanel → Security → SSL/TLS Status → Run AutoSSL to get a trusted free certificate.
- Install the CA bundle. For paid certificates, paste the intermediate bundle into the Certificate Authority Bundle field in SSL/TLS → Manage SSL sites. See incomplete certificate chain.
- Check the chain with
openssl s_client -connect example.com:443 -servername example.com -showcerts; you should see more than one certificate. - Keep Cloudflare proxied if you use an origin certificate, or switch to AutoSSL.
- Replace self-signed certificates created in cPanel; see self-signed certificates in cPanel for when they make sense.
How to fix it as a visitor
- Try another network. If it works on mobile data, the Wi-Fi network is intercepting HTTPS.
- Disable antivirus HTTPS scanning to test.
- Update your operating system.
Danger: Never tell visitors to "click Advanced and proceed". A trusted certificate is free with AutoSSL, so fix it on the server.
FAQ
Is a self-signed certificate secure?
It encrypts traffic but proves nothing about identity, so browsers block it on public sites.
Why does it work in Chrome but not on Android?
Usually a missing intermediate certificate. Install the CA bundle.
Does it affect email too?
Yes, mail clients show similar warnings for mail. hostnames with untrusted certificates.