Browser SSL errors look alarming, but each code points to a specific problem. Read the error code (click Advanced or the warning text in the browser) and use the table below to find the fix.
Before you start
- Check the error on more than one device and network. If only one computer shows it, the problem is probably its clock, antivirus or a network proxy.
- Have cPanel access ready: most fixes are in cPanel → Security → SSL/TLS Status or SSL/TLS.
Error reference
| Error | Meaning |
|---|---|
NET::ERR_CERT_COMMON_NAME_INVALID / SSL_ERROR_BAD_CERT_DOMAIN | Certificate does not cover the hostname you visited |
NET::ERR_CERT_DATE_INVALID | Certificate expired or not yet valid, or the device clock is wrong |
NET::ERR_CERT_AUTHORITY_INVALID / SEC_ERROR_UNKNOWN_ISSUER | Self-signed certificate or missing intermediate certificates |
ERR_SSL_PROTOCOL_ERROR | The server did not answer with valid TLS on port 443 |
ERR_SSL_VERSION_OR_CIPHER_MISMATCH | No common TLS version or cipher; often no certificate for that name at all |
ERR_TOO_MANY_REDIRECTS | HTTP and HTTPS redirects send the browser in circles |
Name mismatch
The visitor opened a hostname the certificate does not list, often www versus the bare domain, or a new subdomain.
- Make sure the missing name has a DNS record pointing to MdmHost (A record or CNAME for
www). - In cPanel → Security → SSL/TLS Status select the domain and its
wwwname and click Run AutoSSL. - If you use a paid certificate, check which names it includes; reissue it with the missing name if needed.
Expired certificate
Check the device clock first. If the certificate really expired, run AutoSSL again or renew the paid certificate. See the dedicated renewal guide.
Untrusted issuer
- Self-signed certificate: cPanel shows these for domains without a real certificate. Run AutoSSL to replace it.
- Missing intermediates: a paid certificate was installed without its CA bundle. Desktop browsers sometimes still work, while phones and apps fail. Reinstall with the CA bundle.
Protocol and cipher errors
- The domain may point to a server or CDN that has no certificate for it. Check DNS with the IP checker.
- If you use Cloudflare, set its SSL mode to Full (strict) once the origin certificate is valid, and make sure the edge certificate is active.
- Very old devices that support only obsolete TLS versions cannot connect to modern servers; that is expected.
Redirect loops
Usually caused by two systems forcing opposite schemes, for example Cloudflare in Flexible mode sending HTTP to the server while the server redirects to HTTPS, or a plugin and .htaccess both redirecting. Remove one of the redirects and set Cloudflare to Full (strict).
Warnings without a full-page error
If the page loads but the padlock is missing or shows a warning, the certificate is fine and the page contains mixed content: images, scripts or styles loaded over http://.
Visitor-side causes
- Antivirus software that inspects HTTPS can show its own certificate errors.
- Public Wi-Fi login pages intercept HTTPS until you sign in.
- Corporate proxies may block or replace certificates.