Certificate error messages, explained and fixed

Paste your error into the error finder or pick your tool below. Each page starts with the exact message, shows where it appears with real output, and lists the likely causes, most common first. For every cause you get a safe command to confirm it and a concrete fix: the full chain on nginx, Apache or IIS, a private root in the right trust store, a corrected name, a renewed certificate or a fixed clock.

Many different messages come from just a few problems: a missing intermediate, a root the client does not trust, a name that is not in the certificate, or a date outside the validity period. Browsers often hide the first one; command-line tools and libraries do not.

We never recommend switching verification off. Where people commonly do it, the page explains why it is a trap and what to do instead.

New to certificates? Start with Certificate chains and path validation.