How to fix an SSL certificate not trusted error
An SSL certificate not trusted error means the client accepted the connection but will not trust the certificate, because it cannot build a path to a certificate authority root it already holds. The three real causes are a missing intermediate, a self-signed certificate, or a certificate from an authority the client does not carry. Diagnosing which comes first.
- Likely cause
- No trusted path from the certificate to a root the client holds
- Severity
- High — the client blocks or warns on the connection
- Time to fix
- About 10 minutes for the common chain case
- Prevention
- Serve the full chain from a publicly trusted authority
What causes it
- The server omits the intermediate that links the leaf to a trusted root.
- The certificate is self-signed, which no public client trusts.
- The certificate comes from a private or internal authority whose root the client does not have installed.
How to fix it
1. Find out why the client distrusts it
Verify the chain. A local-issuer error means a missing intermediate; a self-signed result means no authority vouches for it.
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | grep "Verify return code"2. For the chain case, serve the full chain
Point the server at the full-chain file so the intermediate travels with the leaf.
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;3. For self-signed or private CAs, use a public certificate
For anything a public visitor reaches, replace a self-signed or private-CA certificate with one from a publicly trusted authority (certbot needs an authenticator plugin, named here for nginx). For internal-only clients, distribute the private root to them instead.
sudo certbot certonly --nginx -d example.com
How to prevent it
Serve a full chain from a publicly trusted certificate authority for anything public, keep self-signed and private-CA certificates to networks you control, and verify trust from outside after each change.
Source: RFC 5280 (certification path validation)
Common questions
Why is my self-signed certificate not trusted?
Nothing vouches for a self-signed certificate, so no public client trusts it. Use a certificate from a publicly trusted authority for anything visitors reach, or install your private root on the clients that should trust it.
The certificate is valid but still not trusted. Why?
Validity is separate from trust. The client cannot connect a valid certificate to a root it holds, usually because the intermediate is missing. Serve the full chain.
Fixed it? Catch the next one before your visitors do — monitor the certificate from outside, 3 free, no card.