# SSL/TLS errors explained: fixes for browsers, servers and code

> Look up any SSL/TLS error by its exact text: what it means, whether the site or your device is at fault, and the commands that fix it.

Source: https://ssl.sh/errors/
Last updated: 2026-11-10

Each page here explains one exact error string, such as `NET::ERR_CERT_DATE_INVALID` or `SEC_ERROR_UNKNOWN_ISSUER`: what it means, whether the site or your device is at fault, and the fix. Search for the text you see and work through the matching page from top to bottom.

## How to use these pages

**Start by testing the site, not your computer.** Enter the domain into the [SSL checker](https://ssl.sh/tools/ssl-checker/), or run this from any terminal:

```bash
curl ssl.sh/example.com
```

The checker connects from our servers with an up-to-date trust store and reports the certificate, chain, protocol versions and common misconfigurations. That single result splits every problem into two paths:

- **The check fails too.** The site is misconfigured: an expired certificate, a missing intermediate, a hostname mismatch or an old TLS setup. If you run the site, follow the "How site owners fix it" section of the error page. If you are only a visitor, there is nothing safe to fix on your side; tell the site owner and wait.
- **The check passes, but your browser still complains.** The cause is on your device or network: the clock, antivirus HTTPS scanning, a company proxy, a Wi-Fi login page, or an operating system too old to trust current root certificates. The "Is it the site or your device?" section on each page tells you what to check first.

## What each page contains

Each error page lists the causes in order of likelihood, shows how the same failure looks in Chrome, Firefox, Safari, Edge and on phones, and gives copy-paste server configuration for Nginx, Apache and common panels. Related tools such as the [chain builder](https://ssl.sh/tools/chain-builder/), [certificate decoder](https://ssl.sh/tools/certificate-decoder/) and [TLS config generator](https://ssl.sh/tools/tls-config-generator/) are linked where they shorten the fix.

We never recommend clicking through a certificate warning on a site you do not control: it removes the only protection against someone intercepting the connection.