How to fix ERR_CERT_AUTHORITY_INVALID
ERR_CERT_AUTHORITY_INVALID means the browser read your certificate but could not build a path from it to a certificate authority root it already trusts. In practice this is almost always a missing intermediate certificate, a self-signed certificate, or a certificate from a certificate authority the client does not trust.
- Likely cause
- No trusted path: missing intermediate, self-signed, or untrusted CA
- Severity
- High — visitors get a full-page trust warning
- Time to fix
- About 10 minutes for the common missing-intermediate case
- Prevention
- Serve the full chain and verify it from outside
What causes it
- The server sends only the leaf certificate and omits the intermediate that links it to the trusted root.
- The certificate is self-signed, so no trusted authority vouches for it.
- The certificate was issued by an internal or private authority whose root the visitor’s browser does not carry.
How to fix it
1. Verify the chain the server actually sends
Ask openssl to build and verify the chain from what the server presents. A "verify error" about the local issuer certificate points straight at a missing intermediate.
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null2. Serve the full chain, not just the leaf
Point the web server at the full-chain file your certificate authority provided (leaf plus intermediates), not the leaf-only file. For ACME clients this file is fullchain.pem.
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;3. Reload and re-verify
Reload the server, then confirm the chain now validates end to end from an outside client.
sudo systemctl reload nginx
How to prevent it
Always deploy the full-chain file, and check the served chain from outside after every renewal, since a certificate authority can rotate intermediates and leave your bundle stale.
Source: RFC 5280 (certification path validation)
Common questions
Why does it work in Chrome but fail elsewhere?
Chrome can sometimes fetch a missing intermediate on its own; many other clients cannot. A chain that only Chrome accepts is an incomplete chain that needs the intermediate served.
My certificate is valid though. Why the authority error?
Validity is not the issue. The browser cannot connect your valid certificate to a trusted root because the linking intermediate is not being served. Serve the full chain.
Fixed it? Catch the next one before your visitors do — monitor the certificate from outside, 3 free, no card.