How to Fix SSL Certificate Error (Complete Website Troubleshooting Guide)

An SSL certificate error occurs when a browser or application cannot verify the security certificate presented by a website. When this happens, visitors may see warnings such as "Your connection is not private," "SSL certificate is invalid," or "NET::ERR_CERT_AUTHORITY_INVALID."

SSL certificates help establish encrypted HTTPS connections between websites and visitors. If a certificate is expired, incorrectly installed, issued for the wrong domain, or not trusted, browsers may block access or display security warnings.

This issue can affect WordPress websites, Laravel applications, custom PHP projects, APIs, and other websites using HTTPS.

In this guide, you'll learn how to identify common SSL certificate problems and fix them step by step.

Why Does an SSL Certificate Error Happen?

An SSL certificate error usually means the certificate or HTTPS configuration cannot be validated.

Common causes include:

• SSL certificate has expired.
• SSL certificate is not installed correctly.
• Certificate does not match the website's domain name.
• Intermediate certificates are missing.
• Website is using a self-signed certificate.
• Domain DNS points to the wrong server.
• Server is presenting an outdated certificate.
• HTTPS configuration is incorrect.
• Certificate renewal failed.
• Server date and time are incorrect.
• Application or API is using an outdated certificate authority bundle.

Let's explore the solutions.

1. Check Whether Your SSL Certificate Has Expired

An expired SSL certificate is one of the most common causes of HTTPS security warnings.

SSL certificates have a validity period. Once the certificate expires, browsers no longer trust it.

You can check your certificate using OpenSSL:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates

Replace example.com with your actual domain.

The output displays:

notBefore=...
notAfter=...

The notAfter value indicates the certificate's expiration date.

How to Fix It

If your certificate has expired:

1. Log in to your hosting control panel.
2. Open the SSL/TLS or security section.
3. Check the certificate status.
4. Renew or reissue the certificate.
5. Verify that the renewed certificate is installed.
6. Test your website using HTTPS.

If you're using Let's Encrypt, check whether automatic renewal is working.

For Certbot, run:

sudo certbot renew --dry-run

This tests the renewal process without replacing your existing certificates.

If renewal fails, review the Certbot output and fix the reported validation or configuration issue.

2. Install the SSL Certificate Correctly

Sometimes a certificate is issued successfully but is not installed correctly on the server.

A typical SSL installation requires:

• SSL certificate file.
• Private key.
• Intermediate certificate chain.

The private key must match the certificate. The server must also provide the required intermediate certificates so browsers can build a trusted certificate chain.

For Nginx

A typical Nginx HTTPS configuration looks like this:

server {
    listen 443 ssl;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    root /var/www/example/public;
    index index.php index.html;
}

For Let's Encrypt, fullchain.pem normally contains the server certificate and required intermediate certificates.

After updating the configuration, test it:

sudo nginx -t

If the configuration is valid, reload Nginx:

sudo systemctl reload nginx

For Apache

A typical Apache SSL virtual host configuration looks like this:

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com

    SSLEngine on
    SSLCertificateFile /path/to/fullchain.pem
    SSLCertificateKeyFile /path/to/privkey.pem

    DocumentRoot /var/www/example/public
</VirtualHost>

Make sure the certificate paths are correct and the required SSL modules are enabled.

Test the Apache configuration before reloading the service:

sudo apachectl configtest

Then reload Apache:

sudo systemctl reload apache2

The exact file paths and configuration may differ depending on your hosting environment.

3. Fix the SSL Certificate Domain Name Mismatch

A domain mismatch occurs when the certificate does not cover the domain visitors are accessing.

For example, your website may use:

https://www.example.com

But the installed certificate only covers:

example.com

These are different hostnames from the certificate validation perspective.

How to Fix It

Check which domain names are included in your certificate:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName

Look for the DNS entries in the output.

Make sure the certificate covers every hostname visitors use, including:

• example.com
• www.example.com
• Any required subdomains.

If a hostname is missing, reissue the certificate with the correct domain names.

Also verify that your DNS records point to the server where the correct certificate is installed.

4. Fix Missing Intermediate Certificates

A certificate may be valid, but browsers can still report a certificate chain error if the server does not provide the required intermediate certificates.

The certificate chain connects your website's certificate to a trusted root certificate authority.

If an intermediate certificate is missing, some browsers and applications may fail to verify the connection.

How to Fix It

Check your certificate chain:

openssl s_client -connect example.com:443 -servername example.com -showcerts

Review the certificate output and verification result.

If the chain is incomplete:

1. Download the correct intermediate certificate from your certificate authority.
2. Configure your web server to provide the full certificate chain.
3. For Let's Encrypt, use fullchain.pem instead of only cert.pem.
4. Reload your web server.
5. Test the HTTPS connection again.

Do not randomly combine certificate files. Use the chain provided by your certificate authority.

5. Fix the NET::ERR_CERT_AUTHORITY_INVALID Error

The NET::ERR_CERT_AUTHORITY_INVALID browser error usually indicates that the certificate was issued by an authority the browser does not trust.

Common reasons include:

• Self-signed SSL certificate.
• Missing intermediate certificates.
• Certificate issued by an untrusted authority.
• Incorrect certificate installation.
• HTTPS traffic intercepted by a proxy or antivirus product.

How to Fix It

If this is a public website:

• Install a certificate issued by a trusted certificate authority.
• Verify the complete certificate chain.
• Replace self-signed certificates with a trusted certificate.
• Check whether a CDN or proxy is presenting a different certificate.
• Confirm that the correct certificate is installed on the active server.

For internal development environments, a self-signed certificate may be acceptable if it is explicitly trusted on the devices that use it. Do not use an untrusted self-signed certificate for a public production website.

6. Check Your Domain DNS Configuration

An SSL certificate can be installed correctly but still produce errors if the domain points to the wrong server.

For example, your domain may point to an old hosting account while the renewed certificate is installed on a new server.

Check the domain's DNS records:

dig example.com

For IPv4:

dig A example.com

For IPv6:

dig AAAA example.com

Verify that the returned IP addresses match your hosting provider's configuration.

Also check whether your domain uses a CDN or reverse proxy, such as Cloudflare. In that case, the certificate presented to visitors may be different from the certificate installed on your origin server.

Update incorrect DNS records and allow time for DNS changes to propagate.

7. Fix HTTPS and Mixed Content Issues in WordPress

WordPress websites sometimes show security warnings or an insecure padlock after installing an SSL certificate.

One possible cause is mixed content.

Mixed content happens when an HTTPS page loads some resources over HTTP, such as:

• Images.
• JavaScript files.
• CSS stylesheets.
• Fonts.
• External scripts.

How to Fix It

First, make sure your WordPress site uses HTTPS.

Go to:

WordPress Dashboard → Settings → General

Check these values:

WordPress Address (URL): https://example.com
Site Address (URL): https://example.com

Then inspect your browser's developer console for mixed-content warnings.

Update hardcoded HTTP URLs in your theme, plugins, database content, and custom scripts.

Before making database-wide URL replacements, create a backup and use a WordPress-aware search-and-replace tool that handles serialized data correctly.

Also check whether your CDN, caching plugin, or page builder is serving outdated HTTP resources.

8. Fix SSL Certificate Errors in Laravel and PHP Applications

Laravel and custom PHP applications can encounter SSL errors when making outgoing HTTPS requests to APIs or external services.

For example, a Laravel application using the HTTP client may return an error such as:

cURL error 60: SSL certificate problem: unable to get local issuer certificate

This commonly happens when the server's CA certificate bundle is missing, outdated, or incorrectly configured.

How to Fix It

First, make sure your server's CA certificates are installed and updated.

For Ubuntu or Debian:

sudo apt update
sudo apt install ca-certificates
sudo update-ca-certificates

For a PHP environment using cURL, check your PHP configuration for these settings:

curl.cainfo = "/path/to/cacert.pem"
openssl.cafile = "/path/to/cacert.pem"

Use a valid CA bundle path for your server.

Restart PHP-FPM or your web server after changing PHP configuration.

Laravel HTTP Client Example

A normal Laravel request should validate the remote server's certificate:

use Illuminate\Support\Facades\Http;

$response = Http::get('https://api.example.com/data');

If certificate validation fails, investigate the CA bundle and remote server certificate rather than disabling verification.

Important: Avoid using withoutVerifying() in production. Disabling SSL verification removes an important security check and can expose your application to man-in-the-middle attacks.

9. Check Your Server Date and Time

SSL certificates have validity dates.

If your server's clock is significantly incorrect, certificate validation may fail even when the certificate itself is valid.

Check the server time:

date

On Linux systems using systemd, check time synchronization:

timedatectl status

If time synchronization is disabled or the system clock is incorrect, configure NTP or your server's time synchronization service.

Correcting the server time can resolve certificate validation problems caused by an incorrect system clock.

10. Renew Let's Encrypt SSL Certificates Automatically

Let's Encrypt certificates are short-lived, so automatic renewal is important.

If automatic renewal stops working, your website may eventually display an expired certificate error.

Check installed certificates:

sudo certbot certificates

Test renewal:

sudo certbot renew --dry-run

If the test fails, inspect the error details.

Common renewal problems include:

• Port 80 is blocked.
• DNS records point to the wrong server.
• Domain validation fails.
• Web server configuration is incorrect.
• Certificate renewal hooks are failing.

Make sure your renewal mechanism is enabled and monitor certificate expiration dates.

11. Clear Browser and CDN Cache

After fixing an SSL certificate problem, some users may continue seeing the previous error because of cached information or because a CDN is still presenting an outdated certificate.

Try the following:

• Open the website in a private browsing window.
• Test the domain in another browser.
• Check the certificate directly using OpenSSL.
• Clear the CDN cache if relevant.
• Verify the SSL configuration at both the CDN and origin server.

Remember that clearing browser cache will not fix an incorrectly installed or expired certificate. Always verify the actual certificate being served.

How to Check Your SSL Certificate

You can inspect your website's SSL certificate directly from the terminal:

openssl s_client -connect example.com:443 -servername example.com </dev/null

This command helps you inspect:

• Certificate details.
• Certificate chain.
• Server response.
• Verification result.

You can also use a reputable online SSL testing tool to check certificate validity, hostname coverage, and chain configuration.

How to Prevent SSL Certificate Errors

Follow these practices to reduce future SSL problems:

• Enable automatic SSL certificate renewal.
• Monitor certificate expiration dates.
• Use certificates from trusted certificate authorities.
• Install complete certificate chains.
• Verify all required domain names are covered.
• Keep server CA certificates updated.
• Monitor DNS and CDN configuration changes.
• Test HTTPS after server migrations.
• Keep web server and PHP configurations updated.
• Avoid disabling SSL verification in production applications.

Final SSL Certificate Troubleshooting Checklist

Before considering the issue resolved, verify the following:

• SSL certificate has not expired.
• Certificate matches the domain name.
• Certificate is issued by a trusted authority.
• Required intermediate certificates are installed.
• Correct certificate is served by the web server or CDN.
• Domain DNS points to the correct server.
• Nginx or Apache HTTPS configuration is valid.
• Server date and time are correct.
• PHP and Laravel CA certificate configuration is valid.
• Automatic certificate renewal is working.
• Website resources load over HTTPS without mixed content.

Still Getting an SSL Certificate Error?

If your website continues showing an SSL certificate error after trying these solutions, the problem may involve server configuration, certificate chain issues, DNS, CDN settings, or PHP cURL configuration.

I can help troubleshoot SSL certificate errors on WordPress, Laravel, and custom PHP websites.

Get SSL installed on your website

Share the exact browser or server error message, and I can help identify the cause and find a reliable solution.