<!-- https://pkizerotohero.com/errors/chrome-err-cert-authority-invalid/ | Markdown mirror of the HTML page | PKI Zero to Hero, by Duyutech BV -->

> What NET::ERR_CERT_AUTHORITY_INVALID means in Chrome and Edge, what visitors should do, and how to fix untrusted, private and self-signed certificates.

Source: https://pkizerotohero.com/errors/chrome-err-cert-authority-invalid/ · Last reviewed: 2026-10-20

- Chrome
- Exact text checked with the real tool

# NET::ERR\_CERT\_AUTHORITY\_INVALID

Also seen in: Edge, Brave, Opera, Electron apps, Android WebView

**In one sentence:**

Chrome could not link the site's certificate to a trusted root: it is self-signed, from a private or proxy CA your device does not trust, or from a distrusted CA.

[Check yours: Certificate decoder](https://pkizerotohero.com/tools/decoder/)

## Where you see it

As a full-page warning in Chrome, Edge and other Chromium browsers. The code is `ERR_CERT_AUTHORITY_INVALID` (−202) in Chromium’s [network error list](https://source.chromium.org/chromium/chromium/src/+/main:net/base/net_error_list.h).

```text
Your connection is not private
Attackers might be trying to steal your information from intranet.example.com (for example, passwords, messages, or credit cards). Learn more about this warning
NET::ERR_CERT_AUTHORITY_INVALID
```

Under **Advanced**:

```text
This server could not prove that it is intranet.example.com; its security certificate is not trusted by your computer's operating system. This may be caused by a misconfiguration or an attacker intercepting your connection.
```

Edge words it slightly differently (“Your connection isn’t private”, “This server couldn’t prove that it’s …”), with the same code.

## What it means

Chrome trusts a site’s certificate only if it can build a [certificate chain](https://pkizerotohero.com/handbook/glossary/#certificate-chain) to a [root certificate](https://pkizerotohero.com/handbook/glossary/#root-certificate) in its [trust store](https://pkizerotohero.com/handbook/glossary/#trust-store): the Chrome Root Store plus roots your organisation installed on the device. Here it could not. Either the certificate was not issued by a CA your device trusts, or the connection is being intercepted. Chrome cannot tell those apart, so it stops.

Note

If you are just visiting a website

Do not click “Proceed”. On a public site such as a bank or shop, this error usually means a broken network (hotel or airport Wi-Fi that intercepts traffic) or a problem on the site’s side. Try again on another network. If it is your company’s internal site, contact your IT helpdesk.

## Likely causes

### The certificate is self-signed or from a private CA

Typical for internal web apps, development servers, and the admin pages of routers, printers and storage boxes. Click **Not secure** in the address bar, open the certificate details and look at “Issued by”. A [self-signed certificate](https://pkizerotohero.com/handbook/glossary/#self-signed-certificate) shows the same name in “Issued to” and “Issued by”; a private CA shows your company’s CA name. From a terminal:

```bash
openssl s_client -connect intranet.example.com:443 -servername intranet.example.com -showcerts </dev/null 2>/dev/null | grep -E '^ [0-9]+ s:|^   i:'
```

**Fix for IT:** deploy the company root to managed devices (Group Policy or Intune on Windows, a configuration profile on macOS). Chrome and Edge use roots installed in the operating system:

```powershell
# One Windows machine, as administrator
Import-Certificate -FilePath C:\certs\corp-root.cer -CertStoreLocation Cert:\LocalMachine\Root
```

On Linux, Chrome reads the user’s NSS database: `certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n "Corp Root CA" -i corp-root.pem` (from the `libnss3-tools` package).

**Fix for site owners:** for anything public, use a certificate from a public CA, for example free and automated through ACME with Let’s Encrypt. For internal sites, issue certificates from the company CA whose root IT deploys, not self-signed ones.

### A TLS-inspection product without its root

If many HTTPS sites fail on one device, a [TLS-inspection](https://pkizerotohero.com/handbook/glossary/#tls-inspection) proxy or antivirus product may be re-signing traffic with a root that is not installed on that device. Check “Issued by” on a public site such as `www.google.com`: if it names a security product or your company, ask IT to install that product’s root.

### The CA is no longer trusted by Chrome

Browsers remove CAs that break the rules. For example, Chrome stopped trusting new Entrust TLS certificates (those first logged in Certificate Transparency after 11 November 2024). Certificates from a distrusted CA fail even though nothing changed on the server. Replace the certificate with one from a CA that browsers trust.

### Rarely: a missing intermediate

Chrome can usually download a missing [intermediate certificate](https://pkizerotohero.com/handbook/glossary/#intermediate-certificate) itself, from the AIA address in the certificate. If that download is blocked, the error appears. Site owners should always serve the full chain: see [verify error:num=21](https://pkizerotohero.com/errors/openssl-verify-error-21/).

Warning

Proceeding is not a fix

“Proceed to … (unsafe)” and the `--ignore-certificate-errors` command-line flag make Chrome accept a certificate from anyone, including an attacker on the same network. Teaching staff to click through warnings trains them to do it on the day it is a real attack. Install the right root, or get a properly issued certificate.

## Check yours

*Interactive tool: Certificate decoder (runs in the browser at [/tools/decoder/](https://pkizerotohero.com/tools/decoder/))*

Export the certificate from the browser’s certificate viewer, or copy it from `openssl s_client -showcerts`, and paste it. The decoder shows the issuer and whether the certificate is self-signed.

## Learn why

- [Who do we trust? CAs, trust stores and self-signed certificates](https://pkizerotohero.com/handbook/trust-stores/)
- [Famous failures and what changed](https://pkizerotohero.com/handbook/famous-failures/): why browsers distrust CAs.
- Firefox’s version of this error: [SEC\_ERROR\_UNKNOWN\_ISSUER](https://pkizerotohero.com/errors/firefox-sec-error-unknown-issuer/).

**Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/errors/chrome-err-cert-authority-invalid/).

Last reviewed 20 October 2026Edition 0.9

## Learn why it happens

- [Chapter 12: Who do we trust? CAs, trust stores and self-signed certificates](https://pkizerotohero.com/handbook/trust-stores/)
- [Chapter 13: Certificate chains and path validation](https://pkizerotohero.com/handbook/certificate-chains/)

## Fix it step by step

- [How to create a CSR on Windows (certreq and IIS)](https://pkizerotohero.com/guides/create-csr-windows/)
- [How to trust a private root CA on Windows](https://pkizerotohero.com/guides/add-root-ca-windows/)
- [How to trust a private root CA on macOS](https://pkizerotohero.com/guides/add-root-ca-macos/)

## Everything on this topic

- [Chains and trust stores](https://pkizerotohero.com/topics/chains-and-trust/)