---
title: "ERR_CERT_AUTHORITY_INVALID on Windows: cause and fix"
description: "Corporate Windows machines trust an internal inspection CA pushed by group policy. Off the corporate network — or on a personal device — that CA is missing,…"
canonical: "https://lemwatch.com/errors/err-cert-authority-invalid/on-windows"
source: "https://lemwatch.com"
---

# ERR_CERT_AUTHORITY_INVALID on Windows

> Corporate Windows machines trust an internal inspection CA pushed by group policy. Off the corporate network — or on a personal device — that CA is missing, so every intercepted site fails authority validation.

## Why it happens on Windows

 Corporate Windows machines trust an internal inspection CA pushed by group policy. Off the corporate network — or on a personal device — that CA is missing, so every intercepted site fails authority validation.

## The fix on Windows

 Check whether the certificate issuer is your employer's proxy (Zscaler, Netskope, Blue Coat). If yes, connect to the corporate VPN so the CA is installed. If not, the site is serving an incomplete chain and the fix is server-side.

## If that didn't fix it

 Windows has its own failure mode, but ERR_CERT_AUTHORITY_INVALID has a wider set of causes. The most common one overall is: The server serves only the leaf certificate and omits the intermediate bundle.

 Concatenate the intermediate certificates after the leaf in the certificate file (fullchain, not cert) and reload the server. Desktop Chrome sometimes hides this via caching, so always confirm with an external check.

## Check your own domain

 An external SSL check builds the chain from scratch with no local trust store shortcuts, so it shows a missing intermediate that your own browser may be silently caching around.

## Frequently asked questions

### Why does ERR_CERT_AUTHORITY_INVALID happen on Windows?

 Corporate Windows machines trust an internal inspection CA pushed by group policy. Off the corporate network — or on a personal device — that CA is missing, so every intercepted site fails authority validation.

### How do I fix ERR_CERT_AUTHORITY_INVALID on Windows?

 Check whether the certificate issuer is your employer's proxy (Zscaler, Netskope, Blue Coat). If yes, connect to the corporate VPN so the CA is installed. If not, the site is serving an incomplete chain and the fix is server-side.

### What does ERR_CERT_AUTHORITY_INVALID mean?

 The browser could not build a trust path from the certificate the server sent to a root it trusts. Usually the server is serving only the leaf certificate without its intermediates, or the certificate is self-signed.


## Related

- [All causes of ERR_CERT_AUTHORITY_INVALID](https://lemwatch.com/errors/err-cert-authority-invalid)
- [All website error codes](https://lemwatch.com/errors)
- [ERR_CERT_AUTHORITY_INVALID on iPhone](https://lemwatch.com/errors/err-cert-authority-invalid/on-iphone)
- [ERR_CERT_AUTHORITY_INVALID on WordPress](https://lemwatch.com/errors/err-cert-authority-invalid/in-wordpress)
- [ERR_CERT_AUTHORITY_INVALID on Android](https://lemwatch.com/errors/err-cert-authority-invalid/on-android)
- [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker)
- [ERR_CERT_COMMON_NAME_INVALID: The certificate does not match the hostname](https://lemwatch.com/errors/err-cert-common-name-invalid)
- [Website monitoring overview](https://lemwatch.com/website-monitoring)