FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

The browser says "certificate not trusted"; what are the possible causes? ​

Short answer

The most common causes are: a missing intermediate certificate chain, an internal CA that the client does not recognize, an expired certificate, the domain name not matching the certificate (the wrong certificate being presented, SNI, wildcard scope or access by IP), a self-signed certificate, a wrong client clock, and intercepting TLS inspection. In TR7, the Chain tab of the certificate and the Valid Until column in the list show a missing chain and an expired certificate; the error code of the browser and the openssl s_client output confirm which one it is.

Possible Causes ​

CauseSymptomCheck and solution
Missing intermediate certificateOpens in a desktop browser, error on mobile or in curlThe Chain tab shows the orange Missing intermediate certificate; the chain is completed (How do I add the intermediate certificate chain?)
Certificate signed by an internal CAError only on devices outside the organization or on which the root certificate is not installedThe root CA certificate is distributed to the trust stores of the clients, or for a site open to the internet, a certificate is obtained from a public CA
Expired certificateNET::ERR_CERT_DATE_INVALIDThe red circle in the Valid Until column and the Expiry Health filter; the certificate is renewed (When I renew a certificate, do I need to replace it on each vService one by one?)
Name mismatchNET::ERR_CERT_COMMON_NAME_INVALIDThe CN and SAN values of the presented certificate are checked; if SNI does not match any certificate, the first certificate in the Certificate list of the vService is presented (Can I attach more than one certificate to a vService; how is the right certificate selected (SNI)?)
Wildcard scopeName error for a.b.example.comA wildcard covers only one sublevel (Can I use a wildcard certificate?)
Access by IP addressThe name cannot be verifiedThe site is accessed with the domain name in the certificate
Self-signed certificateNET::ERR_CERT_AUTHORITY_INVALID, "self-signed" warningA certificate is obtained from a trusted CA
Client clockA valid certificate appears "not yet valid" or "expired"The clock and the time zone of the client are corrected
Proxy or antivirus performing TLS inspectionThe issuer of the certificate is not the expected CAThe Issuer value of the certificate is checked in the browser; the root of the inspecting product must be trusted on the client

Diagnosis Steps ​

  1. The full error code of the browser is obtained (from the warning in the address bar or from the details on the error page).

  2. Which certificate and chain are presented is checked:

    text
    openssl s_client -connect 203.0.113.10:443 -servername www.example.com -showcerts </dev/null

  3. In TR7, the certificate row is clicked on the Certificates & PKI → SSL/TLS Certificates screen; CN, DNS and Cert. Validity are read in the Details tab of the preview, and the status of the chain in the Chain tab.

  4. In the Certificate field of the vService, it is checked that the correct certificate is selected, and its order is checked.

  5. For sites open to the internet, an SSL Labs report is obtained.

Commonly Confused Errors ​

  • A version or cipher mismatch is not a trust error; the browser shows a protocol error such as ERR_SSL_VERSION_OR_CIPHER_MISMATCH, and the cause is in the TLS Security Profile settings in the vService.
  • If no certificate is selected for the vService (or the ACME certificate has not been obtained yet), the encrypted frontend row does not terminate TLS and listens unencrypted; instead of a trust error, the browser shows a protocol error such as ERR_SSL_PROTOCOL_ERROR.

How it is done in the documentation

Related questions