The Ultimate Guide To Fixing SSL Certificate Errors (2024)

Introduction ⇨ how to fix SSL certificate errors

SSL Certificates are an important part of securing the data transmission between websites and their visitors. If it were not for this tried and true encryption layer, we would not be able to do the vital tasks online that have become commonplace since the advent of the Internet. Whether it is shopping, banking, or scheduling our doctor appointments, everything in the cyberworld relies on SSL certificates to secure our data.

The proceeding article tutorizes some general procedures that the Everyday Heroes in the Tech World follow when troubleshooting SSL certificate errors. The solutions herein are not geared toward any one specific error code, so some entries will be more relevant than others based on the specifics of your situation. This outline is not a strict or mandatory procedure, but merely a collection of known solutions in guide form that have helped resolve general certificate related errors in the wild. Use this process as a way to rule out the most common troubles that might be tripping you up while going through the motions of How To Fix SSL Certificate Errors.

General Guide Instructions

Our guide covers instructions for the top 5 most used web browser variants on the web running on Linux, Macintosh, and Windows operating systems. We define these browser variant families as: Chromium (Chrome), Firefox, Microsoft Edge/Internet Explorer, Opera, and Apple’s Safari. The browser you are troubleshooting will fall into one of these categories.

Before we begin, lets go over some ground rules. When it comes to transmitting any personal data (PII) it’s very important to recognize the security warning signs your browser displays. These warning are a red flag to the visitor that the browser cannot guarantee that the intended website is the correct recipient you are sending your encrypted traffic to. So it’s vital to scrutinize anything you submit to a website when these warnings are displayed.

Who is this guide for?

This guide is intended for both general website visitors and site or systems administrators alike. It has been split into two major sections halves, the first is general troubleshooting for visitors while the latter half is geared toward server-side issues that must be corrected by an administrator of the site or system in question. It’s also important to remember that these two sections are not mutually exclusive, administrators can use both sections to help replicate and troubleshoot the issues a specific user is facing or all users of the site are facing.

How to fix SSL certificate errors as a website visitor
How to fix SSL certificate errors as an administrator

What is a browser variant?

There are many alternative versions of existing browsers that target specific types of user-bases, feature sets, and/or marketing to a specific audience niche. However, most of these browsers are a variation on the more widely adopted traditional industry giants like: Google Chrome, Mozilla Firefox, Microsoft Edge/Internet Explorer, Opera, and Safari. In addition to covering these “big box” brands, we will also list some of the more popular variants that run on the same source codebase as the errors displayed in these variants should be virtually identical to their predecessor, save for some styling and/or icon differences.

Table of contents & Filters

You will be able to filter the instructions in each section down to one of the browser variant families to access only the relevant instructions for the browser you are troubleshooting. Please take advantage of our table of contents below to get you to the appropriate section of the guide most relevant to your needs or start from the top and work your way down.

How to fix SSL certificate errors as a website visitor

The first portion of this guide will cover the common problems you might face as a website visitor to any HTTPS enabled webpages online. These issues are focused on resolving a problem with your individual system configuration. There are several items to cover here, but none of them are very complicated and you should be able to cruise through them without too much fuss.

It is also recommended for site administrators to follow the visitor solutions as well. If only to rule out the problem being reported isn’t just an issue with a single user’s system configuration. Later on in the guide, there is an admin only section that will not be useful for regular visitors and if you are a visitor and have ruled out all the steps in this section, then chances are you need to report the issue to the website administrators as it’s likely on the server side and unresolvable by just a site visitor.

Step 1 ⇨ Manually review certificate details

In general, the first step when troubleshooting SSL errors is to Manually Review The Certificate Details reported by your browser. As with most things browser related, this process has slight variations based on the browser variant family. Our goal in this stage is to locate any inaccuracies in the certificate data fields that may have caused the browser to report an invalid status for that certificate. Some of the most common items to be cognoscente of while conducting your inspection are as follows.

Step 2 ⇨ Hard Refresh / Force Reload

In order to make browsers as fast as possible they all employ a technique that stores information to a local disk cache a.k.a. “Temporary Internet Files” or “Browsing Data”. These files store recently fetched website content so the browser does not have to fetch those assets again on subsequent page visits. This local caching mechanism ensures things load as quickly as possible on follow-up visits to any website. Consequently, this means if a bad SSL certificate or CA chain was recently cached, the browser would typically still read that cached certificate instead of fetching the most recent version from the web server.

To help eliminate difficulties with stuck cache files, all browsers have a Hard Refresh or Force Reload function. This instructs the browser to ignore any cached information and download everything as if it were the first time visiting the page. This can fix seemingly stuck pages that are not updating as expected with a normal browser refresh and ensures the certificate you are troubleshooting is the most recent.

Performing the Browser Hard Refresh is a rather simple task. Browsers have a few hotkey combinations that trigger this feature. This next section covers all the known methods for performing the cache bypass as documented by Wikipedia.

Step 3 ⇨ Restart your browser

Try not to overlook the obvious. Like all software, sometimes browsers are not holding up their end of the bargain. Stuck processes can prevent a site from loading the most current version until that browser process is restarted and the errant behavior abates.

It is sometimes necessary to forcefully quit or kill off of a stuck browser process before it will behave correctly again. If you’re unsure about how to terminate your browser in this manner, you can simply perform a full power off of your system, which should clean out any stuck processes when booted up again.

While there are some obvious ways to restart a browser, I’ve included some of the less obvious ones. This next section goes over the myriad of ways to restart your browser.

Step 4 ⇨ Browser Privacy Sandbox

Most of today’s browsers come with a built-in privacy focused sandbox feature that can be used for more than just satiating tracking concerns when surfing online. Often referred to as “Incognito“, despite that term being a moniker unique to Chromium browsers, privacy sandboxes are the generic descriptor for this type of feature. Most browsers use a slight variation on the name for this mode, so review the Browser Privacy Sandbox Matrix below to identify the name of the privacy sandbox that is typically used by the relevant browser family.

Since browser caching can end up saving an incorrect certificate, it’s a great practice to use the privacy feature of your browser to make sure you have bypassed any potential browser side caching when viewing the site’s SSL certificate. The next section provides instructions for how to access the privacy mode features in each browser family.

Step 5 ⇨ Verify system clock & time zone

When validating a certificate your browser will check the system time to verify it’s between the validation period for all certificates in the SSL chain. If your clock is displaying the incorrect time (or time-zone is more frequently what is incorrect) then you will need to manually adjust the clock and/or sync the system with a time server. If you are unsure how to verify and correct your systems clock, review the relevant instructions below which should cover most users.

Step 6 ⇨ Temporarily disable VPN & antivirus software

Antivirus & VPN software both have the potential to interfere with SSL validation. They are intrusive programs by design that force normal routines through themselves in an effort to filter out the unwanted or predatory practices encountered in the IT industry the world over. The downside to this type of self-imposed intrusive protection is that they are another link in the chain of trust with the potential of breaking due to a misconfiguration or errant behavior. Ruling out these services as potential problems is pretty simple. Just test the site/application in question again without these products enabled. Below are some of the documentation available for popular operating systems that can help you disable these services so you can perform a test without them in place. There are a very large number of these types of providers out there, so if you are not seeing them listed here, just reach out to their websites to find the assistance you need to temporarily disable them for a test.

Step 7 ⇨ Clear browser cache, cookies, & temporary internet files

Browsers build up cached files almost perpetually. If they are not routinely cleaned and restarted, eventually, an issue will occur where a site or application starts to misbehave erroneously. Thankfully, it’s rather simple and well documented how to do this in just about any browser you can find. Below are some helpful links to the documentation that discusses how to perform these cleaning operations on their given platform. These should cover all the bases.

Step 8 ⇨ Reset browser SSL state (Windows Only)

The SSL State is a cache on the system with SSL certificate information. Sometimes this cache needs to be purged in order for the browser to see a newer certificate authority who may have recently renewed a certificate. There is a separate process for clearing this cache data on Windows systems.

Performing this operation on Linux or Mac systems is done by simply clearing the browser history data in the browser of use and is all that is needed to purge the SSL cache as well. 

How to fix SSL certificate errors as an administrator

As a website or system administrator there are some additional server-side solutions to consider. The previous section does still apply and should be run through to make sure the issue is not a user-level problem as opposed to one on the server-side. Once you have reviewed all the previous answers to this point, then it’s time to start looking on the webserver for the problem. This section will cover the solutions that would be only available to the webserver’s administrators.

Step 1 ⇨ Run an SSL certificate test

A common way to diagnose the specifics of why a website’s certificate may be failing is by use of one of many online SSL testing tools available online. You simply just have to visit them in your browser and input the fully qualified domain name that you are testing into their form field and submit. As with most things, not all of these tools are created equal. Some are better than others and some are more niche. Here are a few reliable ones I’ve come to trust over the years.

Step 2 ⇨ Hard reset web server

During regular operations of thousands of connections between web server restarts a process can become stuck in memory . These zombie processes can cause website behavior issues where settings changes are not read from config for the pre-existing processes in memory.

A hard reset is one step above stopping and starting the web server. It’s a purposeful attempt to make sure any stuck processes are properly removed before starting the web server back online.

The following is the process that I’ve learned to follow to ensure that I am not dealing with one of these stuck process scenarios.

Step 3 ⇨ Reissue/Reinstall SSL certificate & CA-bundle

A common troubleshooting tactic when dealing with SSL problems like an invalid certificate authority is to reinstall the original certificate and the CA bundle that was originally provided by the CA who issued the cert.

Most CA allow a certificate owner to have their certificate reissued. A reissued certificate is a replacement certificate with a validity period that starts from the new date of issue. Reissued certs are generated from the original CSR request and retain the previously generated private key. So essentially you can just drop in the new reissued certificate in place of the original without changing anything else.

Step 4 ⇨ Update/Reinstall OpenSSL & CA-certificate packages

There are two important packages that can become damaged or outdated that may need to be reinstalled. The package names are:

• ca-certificates – Common CA certificates
• openssl – Secure Sockets Layer toolkit – cryptographic utility

If these packages are particularly old due to lack of updates, downtime, or a configuration issue with the package manager, it’s possible that either of them need updating or reinstalled to restore functionality.

This is not common as these packages are critical for network security in the modern age, but you might find yourself troubleshooting an older end of life system some day and it’s important to make sure these packages and their prerequisites are installed to the most recent versions available.

Step 5 ⇨ Replace/Renew existing SSL certificate

If all the above has failed to identify and correct the issue with your certificate and or certificate authority, the final tool in the box is to simply order a new certificate. Preferably from a more reputable certificate authority. There are a large number of certificate resellers out there but only a few true certificate authorities. If you’re still having trouble at this stage of the article, chances are you may have ordered your current certificate from a less trusted source. So why not go straight to the source and order from one of the power-houses in the industry:

If you need help installing your SSL certificate, check out this helpful video: