SSL error fixes
The SSL and TLS errors that block a site, each with what it means, the exact commands to fix it, and how to keep it from coming back.
- How to fix ERR_CERT_DATE_INVALIDERR_CERT_DATE_INVALID means the certificate is expired, not yet valid, or the machine clock is wrong. Find which, with the exact commands, and fix it.
- How to fix ERR_SSL_PROTOCOL_ERRORERR_SSL_PROTOCOL_ERROR means the TLS handshake failed before a certificate was even read. Here are the real causes and the commands to isolate each.
- How to fix ERR_CERT_AUTHORITY_INVALIDERR_CERT_AUTHORITY_INVALID means the browser cannot build a trusted chain to a root it holds. Usually a missing intermediate or a self-signed cert. Fix it here.
- How to fix ERR_CERT_COMMON_NAME_INVALIDERR_CERT_COMMON_NAME_INVALID means the certificate does not list the hostname you visited. Check the SAN list and reissue for the right names. Steps here.
- How to fix an incomplete certificate chainAn incomplete certificate chain works in some clients and fails in others. How to spot it, serve the full chain, and verify the fix from outside.
- How to fix a missing intermediate certificateA missing intermediate certificate breaks the trust chain for strict clients. Find the right intermediate, serve the full chain, and verify. Commands inside.
- How to fix ERR_SSL_VERSION_OR_CIPHER_MISMATCHERR_SSL_VERSION_OR_CIPHER_MISMATCH means client and server share no protocol version or cipher. Enable modern TLS and re-test. Exact commands here.
- How to fix ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEYERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY means the server uses a Diffie-Hellman group that is too small. Move to ECDHE or a 2048-bit group. Commands inside.
- How to renew an expired SSL certificateRenew an expired SSL certificate the right way: issue the new one, reload the server so it is actually served, and verify the live host. Commands inside.
- How to fix an SSL certificate not trusted errorAn SSL certificate not trusted error means the client cannot chain to a root it holds. Diagnose the cause — chain, self-signed, or CA — and fix it here.