# "Your connection is not private": causes and fixes by code

> Chrome and Edge show "Your connection is not private" when a site's certificate fails a check. The NET:: code underneath tells you exactly why.

Source: https://ssl.sh/errors/your-connection-is-not-private/
Last updated: 2026-11-10

**"Your connection is not private" means Chrome could not verify the website's certificate, so it stopped before sending anything.** The page itself is generic; the code underneath it (for example `NET::ERR_CERT_DATE_INVALID`) tells you the specific reason, and each code has its own page below.

## Is it the site or your device?

Date, name and issuer errors on one site usually belong to the site; errors on every site point to your device or network. Test the site from outside your network first. Use the [SSL checker](https://ssl.sh/tools/ssl-checker/) or run:

```bash
curl ssl.sh/example.com
```

- **The check fails as well:** the site's certificate or server configuration is broken. As a visitor, you cannot fix it safely; contact the owner or come back later.
- **The check passes:** something between your browser and the site is changing the result. Typical culprits are a wrong date, antivirus HTTPS scanning, a company firewall that inspects TLS, or public Wi-Fi that has not been logged into yet.

If every HTTPS site shows the warning, look at your device. If only one site does, look at that site.

## Causes

NET::ERR_CERT_DATE_INVALID is the most common code, followed by NET::ERR_CERT_AUTHORITY_INVALID and NET::ERR_CERT_COMMON_NAME_INVALID. Click the code under the warning (or "Advanced") and match it below.

### 1. NET::ERR_CERT_DATE_INVALID

The certificate expired or your clock is wrong. See [NET::ERR_CERT_DATE_INVALID](https://ssl.sh/errors/net-err-cert-date-invalid/).

### 2. NET::ERR_CERT_AUTHORITY_INVALID

Chrome does not trust the issuer: a self-signed certificate, a private CA, or an antivirus/proxy certificate. See [NET::ERR_CERT_AUTHORITY_INVALID](https://ssl.sh/errors/net-err-cert-authority-invalid/).

### 3. NET::ERR_CERT_COMMON_NAME_INVALID

The certificate does not list the hostname you typed, often the `www` or bare domain. See [NET::ERR_CERT_COMMON_NAME_INVALID](https://ssl.sh/errors/net-err-cert-common-name-invalid/).

### 4. Less common codes

| Code | Meaning | Page |
|---|---|---|
| NET::ERR_CERT_REVOKED | The CA revoked the certificate | [details](https://ssl.sh/errors/net-err-cert-revoked/) |
| NET::ERR_CERT_INVALID | The certificate is malformed or violates a rule | [details](https://ssl.sh/errors/net-err-cert-invalid/) |
| NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED | No valid CT proof (SCTs) | [details](https://ssl.sh/errors/err-cert-transparency-required/) |
| NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM | SHA-1 or MD5 signature | [details](https://ssl.sh/errors/net-err-cert-weak-signature-algorithm/) |
| ERR_SSL_KEY_USAGE_INCOMPATIBLE | Private-CA RSA cert lacks the right key usage | [details](https://ssl.sh/errors/err-ssl-key-usage-incompatible/) |

### 5. Your network or security software

If the code is `NET::ERR_CERT_AUTHORITY_INVALID` on every site and the certificate's issuer is named after an antivirus product or your company, read [antivirus HTTPS scanning](https://ssl.sh/errors/antivirus-https-scanning-ssl-error/) and [corporate SSL inspection](https://ssl.sh/errors/corporate-ssl-inspection/).

## What it looks like in each browser

| Browser | Warning title |
|---|---|
| Chrome, Brave, Opera | "Your connection is not private" |
| Edge | "Your connection isn't private" |
| Firefox | "Warning: Potential Security Risk Ahead" ([details](https://ssl.sh/errors/firefox-potential-security-risk-ahead/)) |
| Safari | "This Connection Is Not Private" ([details](https://ssl.sh/errors/safari-this-connection-is-not-private/)) |
| Chrome on Android | Same as desktop, with the code below the text |

Protocol problems such as `ERR_SSL_PROTOCOL_ERROR` use a different page, "This site can't provide a secure connection", covered in [ERR_SSL_PROTOCOL_ERROR](https://ssl.sh/errors/err-ssl-protocol-error/).

## How site owners fix it

Renewing on time, covering every hostname and serving the full chain fix nearly every case.

**1. See what visitors see.** Run the [SSL checker](https://ssl.sh/tools/ssl-checker/) or `curl ssl.sh/example.com`. It reports expiry, hostnames, chain completeness and protocol support in one pass.

**2. Fix the specific code.** Renew expired certificates, add missing hostnames to the SAN list, and serve the full chain. The [chain builder](https://ssl.sh/tools/chain-builder/) produces the correct bundle from your leaf certificate.

**3. Check every endpoint.** The CDN, load balancer and origin all hold separate certificates. Test each one:

```bash
curl -sv --resolve example.com:443:203.0.113.10 https://example.com/ -o /dev/null 2>&1 | grep -E "subject|issuer|expire"
```

**4. Keep it from coming back.** Automate renewal with ACME and monitor expiry; with public certificate lifetimes capped at 200 days from March 2026, a manual process will eventually miss a date.