--- title: "ERR_CERT_AUTHORITY_INVALID: causes and how to fix it" description: "The browser could not build a trust path from the certificate the server sent to a root it trusts. Usually the server is serving only the leaf certificate…" canonical: "https://lemwatch.com/errors/err-cert-authority-invalid" source: "https://lemwatch.com" --- # ERR_CERT_AUTHORITY_INVALID: The certificate is not issued by a trusted authority > The browser could not build a trust path from the certificate the server sent to a root it trusts. Usually the server is serving only the leaf certificate without its intermediates, or the certificate is self-signed. ## Short answer The browser could not build a trust path from the certificate the server sent to a root it trusts. Usually the server is serving only the leaf certificate without its intermediates, or the certificate is self-signed. ## What ERR_CERT_AUTHORITY_INVALID means Trust in TLS is a chain: leaf → intermediate(s) → root. The browser only ships the roots. If the server does not send the intermediates, the chain is broken and the browser cannot verify the leaf, even though the certificate itself is perfectly valid. ## Causes and fixes, most likely first - The server serves only the leaf certificate and omits the intermediate bundle. Concatenate the intermediate certificates after the leaf in the certificate file (fullchain, not cert) and reload the server. Desktop Chrome sometimes hides this via caching, so always confirm with an external check. - The certificate is self-signed. Self-signed certificates are fine for internal tooling but never for public sites. Issue a free publicly-trusted certificate instead. - An intermediate was cross-signed by a root that has since expired or been distrusted. Reissue the certificate so it chains to a current root. This is what breaks old devices while modern browsers still work. - Corporate TLS interception is re-signing traffic with a private CA the device does not trust. The corporate root has to be installed on the device by IT, or the domain excluded from interception. ## ERR_CERT_AUTHORITY_INVALID on specific platforms - ERR_CERT_AUTHORITY_INVALID on Windows — Corporate Windows machines trust an internal inspection CA pushed by group policy. Off the corporate network — or on a personal device —… - ERR_CERT_AUTHORITY_INVALID on iPhone — A configuration profile or MDM-installed root certificate on iOS can be present but not enabled, so the chain validates on other devices… - ERR_CERT_AUTHORITY_INVALID on WordPress — WordPress sites behind a plugin-managed certificate (Really Simple SSL, host auto-SSL) often serve the leaf certificate only after a… - ERR_CERT_AUTHORITY_INVALID on Android — Older Android versions ship an outdated root store and fail on chains that modern desktop browsers accept. - ERR_CERT_AUTHORITY_INVALID on Cloudflare — Cloudflare Origin Certificates are only trusted by Cloudflare, so hitting the origin directly in a browser always shows this error. ## How to stop it happening again - Always deploy fullchain.pem, never cert.pem alone. - Verify the chain from a clean machine or an external checker after every certificate change — a cached intermediate hides the fault locally. - Watch for CA root deprecation announcements and reissue ahead of them. ## Check your own domain An external SSL check builds the chain from scratch with no local trust store shortcuts, so it shows a missing intermediate that your own browser may be silently caching around. ## Frequently asked questions ### Why does the site work in one browser but not another? Some browsers cache intermediates they have seen before and can complete the chain without the server sending it. A browser that has never seen the intermediate fails. The server is still misconfigured. ### How do I fix a missing intermediate certificate? Replace the certificate file with the full chain — leaf first, then intermediates in order — and reload the web server. Do not include the root. ## Related - [All website error codes](https://lemwatch.com/errors) - [ERR_CERT_DATE_INVALID](https://lemwatch.com/errors/err-cert-date-invalid) - [ERR_CERT_COMMON_NAME_INVALID](https://lemwatch.com/errors/err-cert-common-name-invalid) - [ERR_SSL_PROTOCOL_ERROR](https://lemwatch.com/errors/err-ssl-protocol-error) - [Your connection is not private](https://lemwatch.com/errors/your-connection-is-not-private) - [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker) - [ERR_CERT_AUTHORITY_INVALID on Cloudflare](https://lemwatch.com/errors/err-cert-authority-invalid/in-cloudflare) - [ERR_BLOCKED_BY_CLIENT: An extension blocked the request](https://lemwatch.com/errors/err-blocked-by-client)