NET::ERR_CERT_AUTHORITY_INVALID means Chrome does not trust whoever signed that website’s security certificate. Usually the certificate was swapped out by something on your own side, such as a work filter or antivirus that inspects secure traffic. Select Advanced on the warning page and read the issuer name Chrome prints there. That one line tells you which fix you need.
Who this applies to
- Google Chrome on Windows, Mac, Linux, Chromebook and Android. Not version-specific.
- Some fixes need an administrator, so a work or school device may need your IT desk.
Why does Chrome say the certificate authority is invalid?
Every secure website hands Chrome a certificate, and Chrome checks who signed it. If the signer is not an authority Chrome trusts, the page is blocked. There are four common reasons, and they do not look the same.
- A work or school filter. Every secure site fails, not just one, and the device belongs to an employer or a school. The certificate names your organization, or a firewall product and a serial number, instead of a public authority.
- Antivirus that inspects secure traffic. Every secure site fails, but this is your own personal device. The certificate names your security software.
- A private or self-signed certificate. Only one address fails, and it is a device on your own network such as a router, a printer or a storage box. Nobody public ever signed it, and nobody was meant to.
- A broken chain on the website itself. Only one public website fails, and it fails for other people too. The site is missing part of its certificate chain, and nothing on your device will fix that one.
How do you tell which one is yours?
How do you fix NET::ERR_CERT_AUTHORITY_INVALID?
On the warning page, select Advanced. Chrome prints the certificate’s subject, its issuer, and its expiry date, right under the error code. Look at the issuer. A public authority has a company name you can look up. A work filter usually shows your employer’s name, or a product name and serial number from a firewall appliance. Antivirus shows the name of the security suite. That takes five seconds and sorts all four branches, which saves you trying fixes that never applied.
Every site fails on a work or school device
Your organization runs a filter that opens secure traffic and signs it again on the way through. That only works if the filter’s own certificate is installed and trusted on your device. When the error shows up everywhere, that certificate is usually missing, expired, or not the one the filter is actually using.
Google’s advice here is worth following: ask your administrator. Installing a certificate yourself is a security risk, because you are telling your device to trust every certificate that key will ever sign.
- Select Advanced on the warning page and write down the issuer name.
- Send that name to your IT desk along with the exact error code.
- Let them push the correct certificate to your device.
You can check what is already installed without changing anything. Open Settings, select Privacy and security, then Security, and scroll down to Manage certificates. That row sits well below the fold, under the Advanced group, so you will not see it when the page first opens. If your organization’s authority is already listed and the error still appears, the installed certificate is not the one the filter is using. That is the detail your IT desk needs.
Every site fails on your own device
Look in your security software for a setting called HTTPS scanning, SSL scanning, encrypted connection scanning, or web shield. Suites name it differently.
Safety note: turning off part of your antivirus leaves you less protected while it is off. Do this only long enough to test, and turn it back on as soon as you have an answer.
- Open your antivirus or security suite.
- Find the HTTPS or SSL scanning option and turn it off.
- Reload the page in Chrome.
- Turn the setting back on.
If the page loaded while scanning was off, the scanner is the cause. Update the security software first, because a stale copy of its certificate is the usual reason. Most suites also offer an option to reinstall their certificate, which beats leaving the scanner off.
Only one site fails
- Open the same address on your phone using mobile data, not the same Wi-Fi. If it loads there, the problem is your computer or your network, not the site.
- If it fails on mobile data too, the site owner has to fix their certificate chain. You cannot fix that end.
You are on public Wi-Fi
Cafes, hotels and airports hold you at a sign-in page until you accept their terms. Until you do, the network answers your requests with its own page, and the certificate does not match. Visit any address starting with http:// rather than https:// to bring up the sign-in page instead of the warning.
Quick checks worth a minute
- Open the page in an Incognito window. If it loads, an extension is involved. Turn them all off, then back on one at a time until the error returns.
- Update your operating system. Certificate handling rides along with system updates, so a device that has not updated in a long while falls behind.
One case that survives the fix
Worth knowing if your IT desk installs the certificate and one site still fails. Chrome treats a locally installed authority differently by connection type. Over an ordinary secure connection, an authority your administrator added is honored. Over QUIC, the faster transport Chrome uses with some sites, a locally added authority is not honored for granting trust, only for removing it. So one site still failing after an otherwise good fix is not always an IT mistake.
What does not fix this
- Clearing your cache and cookies. Chrome checks the certificate fresh on every connection. The verdict is not kept in your browsing data, so there is nothing to clear.
- Reinstalling Chrome. On Windows and Mac, Chrome reads trust decisions out of the system certificate store and the keychain, which sit outside Chrome entirely. Removing Chrome and putting it back leaves them where they were.
- Making a new Chrome profile. Same reason on Windows and Mac. Trust in a certificate authority is not a profile setting, so a clean profile starts with the same answer.
- Clicking Proceed. That loads the page without checking who is on the other end. It fixes nothing, the warning returns on the next site, and some sites do not offer the option at all.
- Installing a certificate because a forum post told you to. It can clear the error and still be a bad idea. You would be trusting every certificate that key signs from then on, including ones aimed at you.
Frequently asked questions
Is it safe to click Proceed on this warning?
On a device on your own network that you set up, it is a reasonable call. On a public website, no. Chrome cannot confirm you are talking to the site you typed, so anything you send, including a password, could be going somewhere else.
Why does the site work on my phone but not my work laptop?
Because your phone is probably not going through the same filter. That difference is a useful test. If the site loads on mobile data and fails on the laptop, the cause sits on the laptop or its network.
Should I install the certificate my IT department sent me?
If it came from your own IT desk and the device belongs to your employer, that is the normal way this gets fixed. The warning is about certificates you found yourself. When in doubt, ask them to push it rather than installing it by hand.
Does this error mean the website was hacked?
Almost never. It usually means something in the middle is re-signing traffic, or a site owner set their certificate up wrong. Take it seriously anyway, since a real attack produces the same message.
Summary
The issuer name on the warning page is the whole diagnosis. Read it first, then pick the branch it points to. If it names your employer or your antivirus, the fix belongs to them, not to your browser settings.
Leave a Reply