Your connection is not private: Chrome's certificate warning interstitial

Chrome's full-page warning shown whenever certificate validation fails. It is not a single error — the real cause is the NET::ERR_CERT_* code printed underneath it, and that code tells you which of expiry, trust, or hostname is wrong.

Short answer

Chrome's full-page warning shown whenever certificate validation fails. It is not a single error — the real cause is the NET::ERR_CERT_* code printed underneath it, and that code tells you which of expiry, trust, or hostname is wrong.

What Your connection is not private means

The interstitial is the wrapper Chrome puts around every certificate validation failure. Reading the specific code below the message is the entire diagnosis: DATE_INVALID means expiry, AUTHORITY_INVALID means a broken chain, COMMON_NAME_INVALID means the hostname does not match.

Causes and fixes, most likely first

1. The certificate expired (NET::ERR_CERT_DATE_INVALID). Renew the certificate and reload the web server.
2. The chain is incomplete or the certificate is self-signed (NET::ERR_CERT_AUTHORITY_INVALID). Serve the full chain including intermediates, or replace a self-signed certificate with a publicly trusted one.
3. The hostname does not match the certificate (NET::ERR_CERT_COMMON_NAME_INVALID). Reissue covering the hostname actually in use, including www if visitors reach it that way.
4. The device clock is wrong, so every certificate looks invalid. Set date and time to automatic. If every HTTPS site shows the warning, this is almost certainly why.
5. A public Wi-Fi captive portal is intercepting traffic before you have signed in. Open any plain HTTP page to trigger the portal, sign in, then retry.

Your connection is not private on specific platforms

• Your connection is not private on iPhone — On iOS the warning is usually the network, not the site: hotel, airport and café Wi-Fi intercept HTTPS at the captive portal before you…
• Your connection is not private on Chrome — Chrome caches HSTS state per domain, so once a site has failed it keeps refusing even after the certificate is fixed.
• Your connection is not private on WordPress — A WordPress site half-migrated to HTTPS serves the page over TLS but loads images, scripts or the login form over http://, and the mixed…
• Your connection is not private on Windows — A drifted system clock or a stale Windows certificate store makes valid certificates fail validation across every browser at once.
• Your connection is not private on Mac — A certificate manually marked 'Never Trust' in Keychain Access, or a leftover corporate root, overrides the normal trust decision for that…
• Your connection is not private on Android — An outdated root store on older Android builds rejects chains that current desktop browsers accept.

How to stop it happening again

• Monitor expiry, chain and hostname coverage together — the interstitial can be triggered by any of the three.
• Alert on the certificate as served over the public internet, not as installed on disk.

Check your own domain

Running the check from outside your device separates a real certificate problem from a local clock or network issue in one step.

Frequently asked questions

Why does every website say my connection is not private?

When every site fails, the cause is local: a wrong system clock, a captive portal you have not signed into, or antivirus TLS interception. A single failing site points at that site's certificate.

Is it safe to click Proceed?

On a site you own and are debugging, yes. Anywhere else, no — the browser cannot distinguish a misconfigured certificate from an active interception.

How do I fix this on my own site?

Read the NET::ERR_CERT_* code under the message, then fix that specific cause: renew for DATE_INVALID, serve intermediates for AUTHORITY_INVALID, reissue with the right hostname for COMMON_NAME_INVALID.