Understanding NET::ERR_CERT_AUTHORITY_INVALID
When you connect to an HTTPS website, your browser checks whether the server's certificate was issued by a Certificate Authority (CA) located in the operating system's trusted Root CA store (e.g. DigiCert, Let's Encrypt ISRG Root X1, Sectigo, Google Trust Services).
If the certificate is self-signed, issued by an unverified internal CA, or missing intermediate certificates required to complete the chain of trust, the browser immediately blocks access with NET::ERR_CERT_AUTHORITY_INVALID.
How Webmasters Can Fix the Error
1. Replace Self-Signed Certificates with Free Let's Encrypt / ZeroSSL
Self-signed certificates are rejected by all public browsers. Install a trusted certificate using Certbot:
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com2. Bundle the Intermediate Certificate (Full Chain)
If your certificate was purchased from a commercial CA (e.g., Namecheap, Sectigo, GoDaddy), you must concatenate your server certificate with the intermediate bundle provided by the CA:
cat your_domain.crt intermediate.crt > fullchain.pem⚡ Verify Your Certificate Trust Chain
Inspect your Root CA, Intermediate, and Leaf certificate status right now.
Check Certificate Chain →