NET::ERR_CERT_AUTHORITY_INVALID

Where you see it

As a full-page warning in Chrome, Edge and other Chromium browsers. The code is ERR_CERT_AUTHORITY_INVALID (−202) in Chromium’s network error list.

Your connection is not private
Attackers might be trying to steal your information from intranet.example.com (for example, passwords, messages, or credit cards). Learn more about this warning
NET::ERR_CERT_AUTHORITY_INVALID

Under Advanced:

This server could not prove that it is intranet.example.com; its security certificate is not trusted by your computer's operating system. This may be caused by a misconfiguration or an attacker intercepting your connection.

Edge words it slightly differently (“Your connection isn’t private”, “This server couldn’t prove that it’s …”), with the same code.

What it means

Chrome trusts a site’s certificate only if it can build a certificate chain to a root certificate in its trust store: the Chrome Root Store plus roots your organisation installed on the device. Here it could not. Either the certificate was not issued by a CA your device trusts, or the connection is being intercepted. Chrome cannot tell those apart, so it stops.

Likely causes

The certificate is self-signed or from a private CA

Typical for internal web apps, development servers, and the admin pages of routers, printers and storage boxes. Click Not secure in the address bar, open the certificate details and look at “Issued by”. A self-signed certificate shows the same name in “Issued to” and “Issued by”; a private CA shows your company’s CA name. From a terminal:

openssl s_client -connect intranet.example.com:443 -servername intranet.example.com -showcerts </dev/null 2>/dev/null | grep -E '^ [0-9]+ s:|^   i:'

Fix for IT: deploy the company root to managed devices (Group Policy or Intune on Windows, a configuration profile on macOS). Chrome and Edge use roots installed in the operating system:

# One Windows machine, as administrator
Import-Certificate -FilePath C:\certs\corp-root.cer -CertStoreLocation Cert:\LocalMachine\Root

On Linux, Chrome reads the user’s NSS database: certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n "Corp Root CA" -i corp-root.pem (from the libnss3-tools package).

Fix for site owners: for anything public, use a certificate from a public CA, for example free and automated through ACME with Let’s Encrypt. For internal sites, issue certificates from the company CA whose root IT deploys, not self-signed ones.

A TLS-inspection product without its root

If many HTTPS sites fail on one device, a TLS-inspection proxy or antivirus product may be re-signing traffic with a root that is not installed on that device. Check “Issued by” on a public site such as www.google.com: if it names a security product or your company, ask IT to install that product’s root.

The CA is no longer trusted by Chrome

Browsers remove CAs that break the rules. For example, Chrome stopped trusting new Entrust TLS certificates (those first logged in Certificate Transparency after 11 November 2024). Certificates from a distrusted CA fail even though nothing changed on the server. Replace the certificate with one from a CA that browsers trust.

Rarely: a missing intermediate

Chrome can usually download a missing intermediate certificate itself, from the AIA address in the certificate. If that download is blocked, the error appears. Site owners should always serve the full chain: see verify error:num=21.

Check yours

Try it: Certificate decoderOpen the full tool

Runs in your browser. Nothing you paste is sent anywhere.

Paste a certificate

Try a sampleChoose a sample…A website certificate (www.example.com)An expired certificateA wildcard certificate (*.example.com)A certificate with a Common Name but no SANA self-signed root CAA complete chain: leaf, intermediate and root

-----BEGIN CERTIFICATE----- MIIFxDCCA6ygAwIBAgIQV3/H8mpwNp5raCafwOtSezANBgkqhkiG9w0BAQsFADB7 MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UE CxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSgwJgYDVQQDEx9QS0kg WmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMCAXDTI1MDEwMTAwMDAwMFoYDzIw NTAwMTAxMDAwMDAwWjB7MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8g dG8gSGVybzEnMCUGA1UECxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVk MSgwJgYDVQQDEx9QS0kgWmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMIICIjAN BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAnYTGHkYMca54QPkZcZENin3BHB3t uKdHkDZeKZvJHWqpfXpcZfusLvtJFeTrwWlEDBJuV20vmhaLeV29QeYKaIkm1Ul2 qCkrLUpWn/W9CPosfVqMd1nOrd+Ka9iPSeKlW3YX1P5WqQEjieJhBzT9comdj8qN /PynceTDcLa2mgYw7QhU8trBoLzhYqIJFfoUBk+7lahae8b9G5wKCbDicRM8/ATt 0dO9jCxi6RxJpkKl24ULgNOuFP9gG4nubWA8+BaMeM0LU64wNciFofgM2g/3iHHn zmcoe1z80C7WN+GuzNkWkN8D/tcqrbua0O5fREKKw6PyyxwQsjeMghpxLb0h1KeA ihpQMVgpWbhRkkpvF5odkF9vTJP89Z2y+8cgnUMyTpXATrt8KgC5LdWo5mlTNXC/ MvbCUb1Vz9bvcEx2y29tUeLIAUmyBzhF7zgMUPAOtDbLLCuxgR78T2TWaXB/8WBT XL44Wk5rOe7U+KuBr/t12AcZjaq0AGiNsvfd1P+IFbRivElegpdrM+S3arjOjptP M9sUl9Hc+cszaTpEVcQFFxcIyvq5HVjTlZr4vLKdqlhSkQB9hZUFuWNpnUZEYEnA 1vn/GkHNTJ6pv8XxdNXkFeRaUv3ajCn7CQ3UP/EXJqzBw5fl6aa9lqKTS5kF9rgw EIhwNaSd2O557KUCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E BAMCAQYwHQYDVR0OBBYEFIVx1Hy1TuED0pMkxEcdM+DWWPGiMA0GCSqGSIb3DQEB CwUAA4ICAQBMdaOOM84aoItvumQ/sNzOhXvmLwboTb3oe67wda9TvPMSf2aP3JtP UWsR/9UbZgNE9M41p2+XZlVpsGP1BLEvi5ZwfMWmR876Mw1Zkt8ouY3DWN08egnm IdV2vKwDHhDE93IQ12fjNc8iuMCasoYiXTsmXx3R/+PkNbeBAupZEk6EwTr75PCY IJ2cheL7jQ06xeCCZv815rG+63jGk3tys7A+nUXKqOp9oN/dkEhi+YWiHG9UJ2w/ BDZCFUUoJBia7C3+hcXZAVxtWwTy0A5T/plEsqGcdfCMFA4cOFstthyS/Wnnuw8y cpSiXdUAQbLkJ+CGavr6MXVmDicmnV9p3Pv9EbpGPV8UlxwvoQMf+ajEE4EAaJkN Gc85wOC7Y7wwWkBnzjiyLztqRqOFdHEdM13V+2Gw2545Jk8o2gRizBQ6Ey6rlt2u YdYFqFFQhe2H+VqvJiLKefkN1mVQhvhfAvuoxZWIsDtyJWGs12L06xMj3wG98kne mUJjPzze3swZU39eiaC1MBs6U0oLZE6ZqubmjJd/ppmGyK+7o2SMi0juouvw6rcA J9eUJQLNpiVKmiwzKvPejASpunK5B5JO3Y7NAb4SVU22ItR73bBiRAugPwVajlBN RGcjMkDSiW07/dhN6GgjsNAzXHcTR7/nbILOAWbhBstNFK1mgejlbQ== -----END CERTIFICATE-----

PEM text, several PEM blocks, or a .pem, .crt, .cer or .der file (drop it on the box). Certificates are public, so they are safe to paste.

DecodeClearChoose a file

Export the certificate from the browser’s certificate viewer, or copy it from openssl s_client -showcerts, and paste it. The decoder shows the issuer and whether the certificate is self-signed.

Learn why

• Who do we trust? CAs, trust stores and self-signed certificates
• Famous failures and what changed: why browsers distrust CAs.
• Firefox’s version of this error: SEC_ERROR_UNKNOWN_ISSUER.

In the gameLevel 12: Who do we trust?Registry of Roots, Keystone. In development