The chain is complete and the hostname matches — and the browser still refuses it with NET::ERR_CERT_AUTHORITY_INVALID, because the root at the top of the chain is not one the client trusts. Why this differs from a missing intermediate, the causes in the order they bite, and how to read the trust anchor your server presents.
The hostname matches. The chain is complete — every intermediate is present, each certificate signs the next, and it all leads up to a single certificate at the top. The dates are fine. And the browser still slams the door:
Your connection is not private
NET::ERR_CERT_AUTHORITY_INVALID
Enter fullscreen mode
Exit fullscreen mode
The certificate is valid, unexpired, and CA-signed — and the browser still refuses it with NET::ERR_CERT_COMMON_NAME_INVALID,…
It works in your browser and fails in curl, Node, or Python with "unable to get local issuer certificate." That almost always…
Your site was fine yesterday. This morning every browser is throwing a full-page security warning,...
The most valuable move any security team can make is building a certificate and key inventory.
Chunghwa Telecom and Netlock customers must look elsewhere for new certificates.
You finally did it. You installed Burp Suite. Configured the proxy. Opened your browser. Visited...
