Guides · Website · Certificate
“Your Connection Is Not Private”: Understand the Warning and Restore Access
Read the code displayed, compare with another device and another network, then fix the date, the certificate’s domain name or the chain of trust. The price of the certificate comes after this diagnosis.
The short answer
The “Your connection is not private” warning means the validation of the certificate presented for this address failed. The browser is then protecting the information you might enter. Note the exact code and keep the page closed for logins, payments and sensitive data.
Start by checking the device’s date and time. Then open the site from another device and another network, for example a phone on mobile data. An error that appears on many sites often points to the device, the network or software that inspects connections. An error limited to the same domain across several devices points more to the site’s certificate.
The code points to the fix: invalid date for an expired certificate or a wrong clock, incorrect name for a certificate that covers another address, unknown authority for an incomplete chain, a self-signed certificate or interception. The owner must renew or reinstall the right certificate with its full chain, then test every name in use.
A free Let’s Encrypt certificate is enough for most public sites when it renews automatically. A paid certificate can add a verified identity, support or contractual commitments. The level of encryption is identical for the same technology.
Keep sensitive data off the page
Note the full address, the error code and the time. On a public site, wait for the fix before entering a password or card number, or uploading a document. A screen with no option to proceed anyway may come from HSTS: the site has told the browser to refuse any connection whose certificate fails.
For an internal tool, follow the company’s procedure. A private authority can be legitimate when its trust has been installed on the managed devices; an exception improvised in the browser bypasses that check.
Tell the site, the device and the network apart
First check the date, time and time zone. Then test the same site from another device and another network. Also open a second, well-known site from the original device.
| Result | Cause to examine first |
|---|---|
| One device fails on several sites | Clock, security software, proxy or the device’s configuration |
| All devices on the same network fail | Wi-Fi portal, proxy, filtering or network interception |
| The same domain fails everywhere | Certificate, intermediate chain or the site’s configuration |
| Only one address of the domain fails | Name missing from the certificate, or a different server for that subdomain |
Turn the error into a fix
The general text varies by browser, but the code gives the type of problem. Pass it on as is to your provider, with the address concerned and the result of the two tests.
| Code or type | What it indicates | Fix |
|---|---|---|
| DATE_INVALID / expired certificate | There is a gap between the validity period and the clock | Correct the clock, or renew and then install the certificate |
| COMMON_NAME_INVALID / BAD_CERT_DOMAIN | The certificate covers another name | Issue a certificate for each name in use and configure the right server |
| AUTHORITY_INVALID / UNKNOWN_ISSUER | The chain ends at an unknown authority | Install the complete intermediate chain, or deploy the private authority to managed devices |
| Error on several sites at once | A device or software may be intercepting connections | Check the network, the proxy and the security software |
Install the full certificate, then test every address
Renew the certificate with the authority you chose, install it with the intermediate certificates and attach it to the right site. Check the main domain, its version with or without `www` and every subdomain actually published.
Automate renewal and monitor its result. Let’s Encrypt issues 90-day certificates: this short lifetime works precisely because issuance and deployment are automatic. The outage diagnosis guide also covers the general reduction in the maximum lifetime of public certificates.
What not to do
- Reusing an old certificate meant for another name
- Installing the site’s certificate alone, with the intermediate chain missing
- Forgetting to check that the server loads the renewed version
- Advising visitors to bypass the warning
Pay for a specific need, not for the padlock
DV certificates prove control of the domain. The IV, OV and EV categories add verified information about their holder under rules defined by the CA/Browser Forum. All of them let the browser establish an encrypted connection and authenticate the server for the certificate’s domain name.
| Need | Suitable choice | Point to check |
|---|---|---|
| Business website, blog, online shop or public application | Free public DV with automatic renewal | All names covered, complete chain and monitoring of the renewal |
| Organization identity recorded in the certificate | IV, OV or EV from an authority that offers this validation | Verified information and actual use of that identity |
| Contractual support, a management console or a vendor commitment | A paid plan defined by these services | Support response time, automation and written responsibilities |
| Internal service on managed devices | Private authority run by the organization | Deployment of trust and renewal procedure on all devices |
The price covers defined services, while a site’s trustworthiness is checked separately. Let’s Encrypt limits domain validation to control of the name: the holder’s reputation, business identity and security posture need their own checks. The certificate protects the connection; the content and the company are verified another way.
What to ask your host or provider
What exact code do you reproduce, on which addresses and from which networks?
The codes, the names tested, the devices and the networks, with the time of each test.
Does the certificate cover the main domain, its www version and all published subdomains?
The list of names in the certificate and the list of addresses actually in use.
Does every server send the complete intermediate chain?
A chain test from the outside, on each entry point of the site.
How is renewal triggered, installed and monitored?
The automatic mechanism, its frequency, the failure alert and proof of the last renewal.
What specific need justifies a paid plan for this site?
A verified identity, support, a management tool or a contractual commitment, clearly named.
Sources
- Mozilla Support — What does “Your connection is not secure” mean?
Date, name and unknown-issuer errors, and the causes specific to the device or the network.
- MDN — HTTP Strict Transport Security
Why HSTS enforces HTTPS and removes the option to bypass a certificate error.
- Let’s Encrypt — Official FAQ
Free issuance, automation and the 90-day lifetime of Let’s Encrypt certificates.
- Let’s Encrypt — Certification Practice Statement, version 4.0
The scope and limits of domain validation for the holder and the site.
- CA/Browser Forum — Baseline Requirements
The DV, IV, OV and EV categories and the information verified for each.