How to Fix SSL Certificate Errors
A browser warning scares visitors away straight after they arrive, but the cause is usually one of a few simple problems. Here’s how to find which one you have and fix it.
Find out which problem you have
Enter your domain in the SSL Checker, or run this on any machine with OpenSSL:
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -datesThe output shows who the certificate is for, who issued it and when it expires. Match that to the sections below.
The certificate has expired
This is the most common cause, and it usually means automatic renewal failed. With Let’s Encrypt and Certbot, test renewal first, then renew:
sudo certbot renew --dry-run
sudo certbot renew
sudo systemctl reload nginxIf the test fails, the usual reason is that port 80 is blocked or a redirect stops the validation request. Hosted platforms renew by themselves, so check that your domain’s DNS still points at them.
The name doesn’t match
The certificate has to list the exact address visitors use. A certificate for example.com doesn’t cover www.example.com unless both are included. Reissue it with both names:
sudo certbot --nginx -d example.com -d www.example.comThe chain is incomplete
Your site may work in some browsers and fail in others, or fail on phones. That usually means the server isn’t sending the intermediate certificate. In Nginx, point to the full chain, not just the certificate:
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;The padlock is missing or the page warns about mixed content
The certificate is fine, but the page loads an image or script over http://. Open the browser console to see which file, then change it to https://. If your site still answers on plain HTTP, redirect it and confirm with the Redirect Checker.
Only one person sees the error
If the SSL Checker passes but one device complains, the cause is on that device. A wrong system clock is the classic reason, followed by antivirus software or a company network inspecting traffic.
Stop it happening again
- Confirm that automatic renewal works with a dry run after any server change.
- Set a calendar reminder or uptime alert before the expiry date.
- After fixing a domain, add security headers such as HSTS, but only once HTTPS works everywhere.
