Browser errors
NET::ERR_CERT_AUTHORITY_INVALID: causes and fixes
NET::ERR_CERT_AUTHORITY_INVALIDNET::ERR_CERT_AUTHORITY_INVALID means the certificate was not issued by an authority Chrome trusts. On a single website it usually points to a self-signed, private-CA or incompletely chained certificate. On every website it almost always points to software or a network device intercepting your HTTPS traffic.
Is it the site or your device?
One failing site points to its certificate; every site failing points to interception on your device. Check the site from outside your network with the SSL checker or:
curl ssl.sh/example.com
- The checker reports "untrusted issuer" or "self-signed": the site is at fault. As a visitor, do not bypass the warning on a site that asks for a login or payment.
- The checker reports a trusted chain: something local is replacing the certificate. In Chrome, click the "Not secure" label, open the certificate viewer and read the Issued By field. If it names an antivirus product, your company, or something you do not recognise, the interception is happening on your device or network.
Causes
1. Self-signed or private-CA certificate
Routers, NAS boxes, staging servers and intranet apps often ship with a self-signed certificate or one from an internal CA. Confirm with:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -subject -issuer
If subject and issuer are identical, the certificate is self-signed. Fix: issue a publicly trusted certificate (free from any ACME CA) for anything public; for internal systems, have IT deploy the internal root through device management.
2. The chain cannot be built
The server sends only the leaf certificate and the client cannot fetch the intermediate. Chrome usually repairs this itself, but not always (for example when the AIA URL is unreachable). Rebuild the chain with the chain builder.
3. Antivirus or corporate HTTPS interception
Products that scan HTTPS install their own root certificate. If the root is not in Chrome's view of trusted roots, or the product generates broken certificates, every site fails. See antivirus HTTPS scanning and corporate SSL inspection.
4. A root that Chrome distrusted or does not include
Chrome's root store differs from Windows and macOS. A CA that is distrusted by Chrome, or a root only present in an operating system store, can cause this error in Chrome alone. Check the issuing CA against the Chrome Root Program Policy and switch CA if needed.
5. Outdated device
Old operating systems may lack newer roots. On those devices update the system, or use a browser that ships its own root store.
What it looks like in each browser
| Browser | What you see |
|---|---|
| Chrome / Edge | "Your connection is not private" with NET::ERR_CERT_AUTHORITY_INVALID |
| Firefox | SEC_ERROR_UNKNOWN_ISSUER or MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT |
| Safari | "This Connection Is Not Private"; details say the certificate is not trusted |
| Android apps | Trust anchor for certification path not found (details) |
| curl | SSL certificate problem: unable to get local issuer certificate |
How site owners fix it
A publicly trusted certificate served with its full chain fixes it.
1. Use a publicly trusted certificate. For any site visited by the public, replace self-signed or internal certificates with one from a public CA. With certbot:
sudo certbot --nginx -d example.com -d www.example.com
2. Serve the full chain. Point Nginx at the full-chain file, not the leaf alone:
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
For Apache 2.4.8 and later, SSLCertificateFile should also contain the leaf followed by the intermediates.
3. Verify from outside. Run curl ssl.sh/example.com again; the chain should end at a trusted root with no warnings. Test in Firefox and with curl as well, because Chrome's automatic repair can hide a broken chain.
4. For internal sites, distribute your CA root through Group Policy, MDM or configuration management instead of asking users to click through warnings.
FAQ
Can I make the warning go away by installing the site's certificate?
Only for systems you control, such as an internal tool signed by your company's CA, and only by installing the CA root that your IT team distributes. Never import a certificate offered by an unknown website; doing so lets whoever holds that key impersonate any site to you.
The site works in Chrome but my app says certificate verify failed. Same problem?
Often yes, in reverse. Chrome fetches missing intermediates automatically (AIA fetching), so a broken chain may only fail in apps, curl, Python or Java. See missing intermediate certificate.
Why does the certificate say it was issued by my antivirus?
Your antivirus is decrypting HTTPS to scan it and re-signing each site with its own root. If that root is missing from the browser's trust store, or the product is outdated, you get this error on many sites. Update the product or turn off its HTTPS scanning; see antivirus HTTPS scanning.