ERR_CERT_AUTHORITY_INVALID: The certificate is not issued by a trusted authority
Also searched as: net::ERR_CERT_AUTHORITY_INVALID · certificate authority invalid · self signed certificate
Is ERR_CERT_AUTHORITY_INVALID happening on your domain?
An external SSL check builds the chain from scratch with no local trust store shortcuts, so it shows a missing intermediate that your own browser may be silently caching around.
Free, no signup. Runs from outside your network, which is the only way to tell a server fault from a local one.
Short answer
The browser could not build a trust path from the certificate the server sent to a root it trusts. Usually the server is serving only the leaf certificate without its intermediates, or the certificate is self-signed.
What ERR_CERT_AUTHORITY_INVALID means
Trust in TLS is a chain: leaf → intermediate(s) → root. The browser only ships the roots. If the server does not send the intermediates, the chain is broken and the browser cannot verify the leaf, even though the certificate itself is perfectly valid.
Causes and fixes, most likely first
The server serves only the leaf certificate and omits the intermediate bundle.
Concatenate the intermediate certificates after the leaf in the certificate file (fullchain, not cert) and reload the server. Desktop Chrome sometimes hides this via caching, so always confirm with an external check.
The certificate is self-signed.
Self-signed certificates are fine for internal tooling but never for public sites. Issue a free publicly-trusted certificate instead.
An intermediate was cross-signed by a root that has since expired or been distrusted.
Reissue the certificate so it chains to a current root. This is what breaks old devices while modern browsers still work.
Corporate TLS interception is re-signing traffic with a private CA the device does not trust.
The corporate root has to be installed on the device by IT, or the domain excluded from interception.
ERR_CERT_AUTHORITY_INVALID on specific platforms and devices
How to stop it happening again
- •Always deploy fullchain.pem, never cert.pem alone.
- •Verify the chain from a clean machine or an external checker after every certificate change — a cached intermediate hides the fault locally.
- •Watch for CA root deprecation announcements and reissue ahead of them.
Frequently asked questions
Why does the site work in one browser but not another?
Some browsers cache intermediates they have seen before and can complete the chain without the server sending it. A browser that has never seen the intermediate fails. The server is still misconfigured.
How do I fix a missing intermediate certificate?
Replace the certificate file with the full chain — leaf first, then intermediates in order — and reload the web server. Do not include the root.