ERR_CERT_AUTHORITY_INVALID on Cloudflare

Cloudflare Origin Certificates are only trusted by Cloudflare, so hitting the origin directly in a browser always shows this error.

Why it happens on Cloudflare

Cloudflare Origin Certificates are only trusted by Cloudflare, so hitting the origin directly in a browser always shows this error.

The fix on Cloudflare

This is expected. Test the origin with an SSL tool set to ignore trust, or install a publicly-trusted certificate on the origin if it must be reachable directly.

If that didn't fix it

Cloudflare has its own failure mode, but ERR_CERT_AUTHORITY_INVALID has a wider set of causes. The most common one overall is: The server serves only the leaf certificate and omits the intermediate bundle.

Concatenate the intermediate certificates after the leaf in the certificate file (fullchain, not cert) and reload the server. Desktop Chrome sometimes hides this via caching, so always confirm with an external check.

Check your own domain

An external SSL check builds the chain from scratch with no local trust store shortcuts, so it shows a missing intermediate that your own browser may be silently caching around.

Frequently asked questions

Why does ERR_CERT_AUTHORITY_INVALID happen on Cloudflare?

Cloudflare Origin Certificates are only trusted by Cloudflare, so hitting the origin directly in a browser always shows this error.

How do I fix ERR_CERT_AUTHORITY_INVALID on Cloudflare?

This is expected. Test the origin with an SSL tool set to ignore trust, or install a publicly-trusted certificate on the origin if it must be reachable directly.

What does ERR_CERT_AUTHORITY_INVALID mean?

The browser could not build a trust path from the certificate the server sent to a root it trusts. Usually the server is serving only the leaf certificate without its intermediates, or the certificate is self-signed.