` reads). %>

Fix "Your Connection Is Not Private" in Chrome | TLS Radar

Skip to main content

troubleshooting

July 20, 2026

4 min read

By<br>TLS Radar Team

Fix "Your Connection Is Not Private" in Chrome

Chrome shows 'Your connection is not private' when it refuses to trust the SSL certificate a site presents. Before loading an HTTPS page, Chrome checks three things: that the certificate is within its validity dates, that it matches the hostname, and that it chains to a trusted CA - and the error code under 'Advanced' tells you which check failed. If you are a visitor, the safe move is to leave (unless it is your own site, a known internal tool, or your clock is wrong). If you own the site, each NET::ERR_CERT_* code maps to a specific fix.

Key facts

&bull;<br>Chrome shows 'Your connection is not private' when it will not trust the certificate; the code under 'Advanced' says which check failed.

&bull;<br>Chrome validates three things: the certificate's dates, whether it matches the hostname (via the SAN list), and whether it chains to a CA in Chrome's trust store.

&bull;<br>NET::ERR_CERT_DATE_INVALID = expired; NET::ERR_CERT_COMMON_NAME_INVALID = hostname mismatch; NET::ERR_CERT_AUTHORITY_INVALID = untrusted issuer (often self-signed or a distrusted legacy root).

&bull;<br>NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM = SHA-1; NET::ERR_SSL_VERSION_OR_CIPHER_MISMATCH = TLS config too restrictive; NET::ERR_CERT_REVOKED = the CA revoked it.

&bull;<br>A wrong system clock can make valid certificates look expired, so visitors should check their device time before anything else.

&bull;<br>The dual serverAuth-plus-clientAuth EKU is not rejected by Chrome until March 15, 2027; today's AUTHORITY_INVALID errors are usually a distrusted root, not EKU.

Chrome shows "Your connection is not private" with a red shield and a "Back to safety" button when the browser refuses to trust the SSL certificate on the site you're trying to reach. This guide covers what the warning means, the most common causes, and how to fix it - whether you're the site visitor or the site owner.

What Chrome is checking

Before showing you a website over HTTPS, Chrome checks three things about the certificate the server presents:

Is the certificate still valid? Both the start date (notBefore) and end date (notAfter) must include "now."

Does the certificate match the hostname? The domain in the address bar must appear on the certificate's Subject Alternative Name list.

Is the certificate's issuer trusted? The certificate must chain up to a Certificate Authority in Chrome's trust store.

If any of these fail, Chrome shows "Your connection is not private." The specific error code underneath (visible if you click "Advanced") tells you which check failed.

The error codes you'll see

NET::ERR_CERT_DATE_INVALID - the certificate has expired (or is not yet valid).

NET::ERR_CERT_COMMON_NAME_INVALID - the certificate doesn't match the hostname.

NET::ERR_CERT_AUTHORITY_INVALID - the certificate is signed by an issuer Chrome doesn't trust (often a self-signed cert).

NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM - the certificate uses an outdated signing algorithm (SHA-1 in modern Chrome).

NET::ERR_SSL_VERSION_OR_CIPHER_MISMATCH - the server only supports TLS versions or ciphers Chrome refuses to negotiate.

NET::ERR_CERT_REVOKED - the issuing CA revoked the certificate.

If you're a visitor seeing this warning

The safe answer is to leave the site. The warning exists because trust is genuinely broken - entering passwords or payment information is risky.

Three exceptions where it's reasonable to investigate further:

The site is your own. Use the fixes for site owners below.

The site is an internal tool with a known self-signed certificate. Your IT team can add the certificate to your trust store; don't just click through.

Your system clock is wrong. A wrong clock makes valid certificates look expired or not-yet-valid. Check your system time.

If you own the site and need to fix it

For NET::ERR_CERT_DATE_INVALID (expired)

You need a new certificate. The fastest path is a free Let's Encrypt certificate via Beacon:

Need a working certificate right now?

Beacon issues free 90-day Let's Encrypt certificates with a guided DNS-validation flow.<br>No account, no command-line tools, no ACME client to install - just a domain you control.<br>Most people get a working certificate in under 10 minutes.

Get a free certificate from Beacon

For NET::ERR_CERT_COMMON_NAME_INVALID (hostname mismatch)

Your certificate doesn't cover the hostname visitors are using. Either issue a new certificate that includes the hostname in its SAN list, or configure your server to use the right certificate for the right hostname (SNI). Common cases:

A wildcard *.example.com doesn't cover api.eu.example.com (wildcards only cover one level deep).

Multiple sites on one IP with SNI misconfigured - the wrong certificate is being served for one of them.

A new subdomain launched without a matching...