Your connection is not private: what the warning means and how to fix it
"Your connection is not private" is Chrome's headline warning for the whole NET::ERR_CERT_* family of certificate errors, shown whenever the browser receives a certificate it cannot fully trust. The exact code underneath the headline, visible if you click "Advanced," tells you which specific problem it is.
What the warning means
Unlike ERR_SSL_PROTOCOL_ERROR, which fires before any certificate is judged, this warning always means a certificate was received and evaluated, and failed one specific check: its dates, its issuer, its hostname match, or its revocation status. Chrome groups all of these under one alarming headline because the underlying risk is the same either way (the connection might not be talking to who it thinks it is), but the fix depends entirely on which specific NET::ERR_CERT_* code is behind it.
How the warning appears
Chrome shows a full-page red warning: "Your connection is not private - Attackers might be trying to steal your information from example.com," with a "Proceed to example.com (unsafe)" link hidden under "Advanced." Firefox shows "Warning: Potential Security Risk Ahead" with a specific error code. Safari shows "This Connection Is Not Private." Edge mirrors Chrome's wording closely.
What the specific error codes mean
| Code | What it means |
|---|---|
| NET::ERR_CERT_DATE_INVALID | The certificate's validity window does not cover right now, either because it expired, it is not yet valid, or the visitor's device clock is wrong. |
| NET::ERR_CERT_AUTHORITY_INVALID | The certificate was not issued by an authority the browser trusts. Usually a self-signed certificate, a missing intermediate certificate in the chain, or a certificate from an unrecognized or private CA. |
| NET::ERR_CERT_COMMON_NAME_INVALID | The certificate is valid, but it was not issued for the hostname being visited. A wrong or missing entry in the certificate's Subject Alternative Name (SAN) list, often after adding a new subdomain without reissuing the certificate to cover it. |
| NET::ERR_CERT_REVOKED | The certificate authority has explicitly revoked this certificate before its expiry date, typically because the private key was compromised or the certificate was mis-issued. |
Is it your device or the site?
If the warning appears on many different sites, not just one, check your device's clock first: a badly wrong date breaks certificate validation everywhere at once and is one of the most common causes of this warning overall. If it happens on only one site and looks the same from other devices and networks, the certificate itself needs fixing on the server. An SSL check from several locations confirms in one pass whether the certificate problem is consistent everywhere or specific to one visitor's setup.
How to fix "Your connection is not private"
If you are a visitor
- Check your system date and time and set it to sync automatically; this alone resolves a large share of ERR_CERT_DATE_INVALID warnings that have nothing to do with the site.
- If you're on public Wi-Fi, look for a captive portal. Some hotel, airport, or cafe networks intercept the first HTTPS request with their own certificate to redirect you to a login page, which triggers this exact warning; open a plain HTTP site or the network's login page first.
- Check for antivirus HTTPS scanning intercepting the connection with its own certificate; temporarily disabling it and retrying isolates whether that software is the cause.
- Never click through the warning on a site where you are about to enter a password, payment details, or other sensitive information. The warning exists specifically because the browser cannot confirm it is really talking to the site you intended; bypassing it removes that guarantee entirely.
- If you do recognize and trust the site (an internal company tool with a self-signed certificate, for example), that is the one situation where proceeding past the warning, after understanding exactly why it appeared, is a reasonable choice.
If you run the site
- Install the full certificate chain, not just the leaf certificate. ERR_CERT_AUTHORITY_INVALID is frequently caused by a missing intermediate certificate rather than an actual untrusted issuer; verify with
openssl s_client -connect example.com:443 -showcertsthat the full chain is being served in the correct order. - Reissue the certificate with the correct SAN entries whenever ERR_CERT_COMMON_NAME_INVALID appears, making sure every hostname and subdomain actually in use is listed, not just the bare domain.
- Renew before expiry, not after, and set a reminder or automated renewal (such as Let's Encrypt's certbot with a cron job) well ahead of the expiry date rather than reacting to the warning once visitors start reporting it.
- If a certificate was mis-issued or a private key was exposed, revoke and reissue it immediately rather than leaving it live; ERR_CERT_REVOKED on the old certificate is the expected and correct behavior once that happens.
- Never use a self-signed certificate on a public-facing site. It is appropriate for internal tools where every client can be configured to trust it explicitly, but it will trigger ERR_CERT_AUTHORITY_INVALID for every ordinary visitor on a public site.
Related errors
- ERR_CERT_DATE_INVALID covers the expired-or-not-yet-valid case in more detail, including the clock-skew angle.
- ERR_SSL_PROTOCOL_ERROR is the earlier-stage failure where the handshake breaks down before any certificate is even received, unlike every case on this page.
Firefox, Safari and Edge sort the same underlying causes into slightly different labels and colors, but the split between "is it my device" and "is it the site's certificate" holds across all of them: a clock or interception problem on one machine produces the warning everywhere that machine browses, while a genuine certificate defect produces it for every visitor hitting that one site, regardless of which browser they run.
How to prevent it
A certificate problem this visible costs trust the moment a visitor sees it, and expiry in particular is entirely predictable in advance. SSL certificate expiry monitoring tracks the days remaining on a certificate and alerts before it lapses, rather than after visitors start seeing the warning. HostTracker has monitored websites since 2004 from 300+ checkpoints in 158 cities and alerts by email, SMS, voice call, Slack, Telegram and more.
Frequently asked questions
Is it ever safe to click "Proceed anyway"?
Only when you understand exactly why the warning appeared and trust the site regardless, such as an internal tool using a self-signed certificate you set up yourself. Never proceed on a site where you are about to type a password or payment information.
Why do I see this warning on every site, not just one?
That almost always points to your own device's clock being wrong, or occasionally to antivirus or corporate software intercepting HTTPS traffic on your machine. Check the system date first.
What's the difference between an expired certificate and a revoked one?
An expired certificate simply reached the end of its validity window, a routine and expected event if not renewed in time. A revoked certificate was explicitly invalidated early by its issuer, usually because of a security problem such as a compromised private key.
I added a new subdomain and now it shows this warning. Why?
The existing certificate's SAN list likely does not include the new subdomain. Reissue the certificate to cover every hostname actually in use, including any new subdomains.
Does a hotel or airport Wi-Fi login page really cause a certificate warning?
Yes. A captive portal intercepting your first HTTPS request to redirect you to its login page cannot present a valid certificate for the site you were trying to reach, so the browser correctly flags it. Logging into the portal first usually resolves it.