Geonode logo
Secure connection errors

How to Fix ERR_CERT_AUTHORITY_INVALID in Chrome

Read who signed the rejected certificate, then follow the fix for your device, your network or your dev server.

Updated

Get residential proxiesCheck your proxy

TL;DR

ERR_CERT_AUTHORITY_INVALID is Chrome refusing a certificate signed by an authority it does not trust, and it stops the page before any data is sent. On public Wi-Fi, open an http:// page to reach the sign-in screen first; elsewhere, look for antivirus or a work network re-signing HTTPS.

What ERR_CERT_AUTHORITY_INVALID looks like in Chrome and its tools

All rows come from one untrusted certificate; Chrome changes the wording for HSTS sites and known interception software.

WhereWhat you see
Chrome warning page (tab title: Privacy error)Your connection is not private. Attackers might be trying to steal your information from example.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_AUTHORITY_INVALID
Chrome, after clicking AdvancedThis server could not prove that it is example.com; its security certificate is not trusted by your computer's operating system. This may be caused by a misconfiguration or an attacker intercepting your connection.
Chrome on a site that uses HSTS, after clicking AdvancedYou cannot visit example.dev right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later.
Chrome, when the issuer matches known antivirus, firewall or filtering softwareAn application is stopping Chrome from safely connecting to this site
Chrome DevTools console, failed fetch() or subresourceFailed to load resource: net::ERR_CERT_AUTHORITY_INVALID
Puppeteer page.goto()net::ERR_CERT_AUTHORITY_INVALID at https://example.com

Why this happens

Chrome got a certificate whose signer is not on its list of trusted authorities.

Chrome accepts only certificates that lead to its built-in roots or to roots you or an administrator installed. Self-signed dev certificates lead to neither, nor do ones that antivirus, a company firewall or a Wi-Fi sign-in page substitutes.

Diagnose your ERR_CERT_AUTHORITY_INVALID first

The first four checks need no terminal; the last one is for developers.

  • Click the NET::ERR_CERT_AUTHORITY_INVALID code on the warning; if the Issuer line names antivirus, a firewall or your employer, that product re-signed the connection.

  • Compare the Issuer with the Subject in that box; if both show the same name, the server uses a self-signed certificate.

  • Load the page on a second device using this Wi-Fi; if it fails there too, the network or site is the cause, not this computer.

  • Look at the address; if it is localhost, 127.0.0.1 or a test name you run, your development certificate's CA is not trusted yet.

  • Run openssl s_client -connect host:443 -servername host -showcerts; if the last i: line names a private or unknown CA, Chrome lacks that root.

Solutions ranked by effectiveness

Start with the software and network between you and the site; the third fix is for your own dev server.

  1. Most common fix

    Fix HTTPS scanning by antivirus or work proxies

    Applies on a computer with antivirus or a managed work device. Google ties this code to antivirus "HTTPS scanning" and to work proxies such as Zscaler, Palo Alto Networks or Fortinet.

    1. Briefly turn off the antivirus or its "HTTPS scanning", reload, then turn it back on.

    2. If the page loaded with it off, reinstall or uninstall that antivirus.

    3. On a work device, ask IT to install the proxy's certificate; don't install it yourself.

  2. Check next

    Sign in to the Wi-Fi network

    Applies on hotel, cafe or airport Wi-Fi, where a sign-in page answers before the internet does. Chrome may show "Connect to Wi-Fi" instead; its Connect button opens the page.

    1. Open a new tab and go to http://example.com.

    2. Complete the network's sign-in or terms page that appears.

    3. Return to the first tab and reload it.

  3. For developers

    Trust your dev certificate with mkcert

    Applies to localhost and your own test names. Run mkcert -install once, then mkcert localhost 127.0.0.1 ::1, and load the two files it writes.

    # Files come from: mkcert localhost 127.0.0.1 ::1
import http.server, ssl
class Hello(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b"Served over HTTPS with a locally trusted certificate\n")
server = http.server.ThreadingHTTPServer(("localhost", 8443), Hello)
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
ctx.load_cert_chain("localhost+2.pem", "localhost+2-key.pem")
server.socket = ctx.wrap_socket(server.socket, server_side=True)
server.serve_forever()

Stop the ERR_CERT_AUTHORITY_INVALID from coming back

Habits for developers, IT teams and everyday users that keep untrusted certificates out of Chrome.

  1. Name local projects under .test or localhost; Chrome preloads every .dev and .app name as HTTPS-only.

  2. Keep mkcert's rootCA-key.pem private and out of repositories; whoever holds it can intercept HTTPS from your machine.

  3. Push inspection CAs through Group Policy or device management, so every new laptop trusts them from day one.

  4. Turn on automatic operating system updates; Google lists updating Windows or macOS as a step for this warning.

A second opinion on the issuerGeonode's support team helps with technical issues 24/7; include the Issuer line from Chrome's warning.
Try residential proxies

Related errors

Learn more

FAQ

It is Chrome's code for a certificate that does not lead back to a root it trusts, so the page stays blocked. Typical sources are self-signed certificates, private CAs and software or networks that intercept HTTPS.

No. It hides the cause and can expose what you type to whoever issued the untrusted certificate. The only exception is a one-off check of a development server you run yourself; HSTS sites show no such link.

Chrome matched the certificate's issuer to antivirus, firewall or filtering software that wasn't installed properly. It shows this page only when the warning can't be overridden, as on HSTS sites; elsewhere you get the usual privacy warning.

Not this code: a wrong clock gives NET::ERR_CERT_DATE_INVALID with a "Your clock is behind" or "Your clock is ahead" page. Correct the date and time to clear that one.

Yes, if it decrypts HTTPS: a debugging proxy such as mitmproxy re-signs the sites it decrypts with its own CA. A proxy that only tunnels HTTPS with CONNECT passes the site's own certificate through, so Chrome judges the site itself.

If all visitors see it, the server's certificate comes from no public authority. Replace it with one from a CA in the Chrome Root Store, such as Let's Encrypt, whose ISRG Root X1 is listed there.

Copy-ready proxy code

Pick Python, Node.js or Go; Geonode's dashboard writes the snippet from your proxy settings.

Try residential proxies