--- title: "Your connection is not private: causes and how to fix it" description: "Chrome's full-page warning shown whenever certificate validation fails. It is not a single error — the real cause is the NET::ERR_CERT_* code printed…" canonical: "https://lemwatch.com/errors/your-connection-is-not-private" source: "https://lemwatch.com" --- # Your connection is not private: Chrome's certificate warning interstitial > Chrome's full-page warning shown whenever certificate validation fails. It is not a single error — the real cause is the NET::ERR_CERT_* code printed underneath it, and that code tells you which of expiry, trust, or hostname is wrong. ## Short answer Chrome's full-page warning shown whenever certificate validation fails. It is not a single error — the real cause is the NET::ERR_CERT_* code printed underneath it, and that code tells you which of expiry, trust, or hostname is wrong. ## What Your connection is not private means The interstitial is the wrapper Chrome puts around every certificate validation failure. Reading the specific code below the message is the entire diagnosis: DATE_INVALID means expiry, AUTHORITY_INVALID means a broken chain, COMMON_NAME_INVALID means the hostname does not match. ## Causes and fixes, most likely first - The certificate expired (NET::ERR_CERT_DATE_INVALID). Renew the certificate and reload the web server. - The chain is incomplete or the certificate is self-signed (NET::ERR_CERT_AUTHORITY_INVALID). Serve the full chain including intermediates, or replace a self-signed certificate with a publicly trusted one. - The hostname does not match the certificate (NET::ERR_CERT_COMMON_NAME_INVALID). Reissue covering the hostname actually in use, including www if visitors reach it that way. - The device clock is wrong, so every certificate looks invalid. Set date and time to automatic. If every HTTPS site shows the warning, this is almost certainly why. - A public Wi-Fi captive portal is intercepting traffic before you have signed in. Open any plain HTTP page to trigger the portal, sign in, then retry. ## Your connection is not private on specific platforms - Your connection is not private on iPhone — On iOS the warning is usually the network, not the site: hotel, airport and café Wi-Fi intercept HTTPS at the captive portal before you… - Your connection is not private on Chrome — Chrome caches HSTS state per domain, so once a site has failed it keeps refusing even after the certificate is fixed. - Your connection is not private on WordPress — A WordPress site half-migrated to HTTPS serves the page over TLS but loads images, scripts or the login form over http://, and the mixed… - Your connection is not private on Windows — A drifted system clock or a stale Windows certificate store makes valid certificates fail validation across every browser at once. - Your connection is not private on Mac — A certificate manually marked 'Never Trust' in Keychain Access, or a leftover corporate root, overrides the normal trust decision for that… - Your connection is not private on Android — An outdated root store on older Android builds rejects chains that current desktop browsers accept. ## How to stop it happening again - Monitor expiry, chain and hostname coverage together — the interstitial can be triggered by any of the three. - Alert on the certificate as served over the public internet, not as installed on disk. ## Check your own domain Running the check from outside your device separates a real certificate problem from a local clock or network issue in one step. ## Frequently asked questions ### Why does every website say my connection is not private? When every site fails, the cause is local: a wrong system clock, a captive portal you have not signed into, or antivirus TLS interception. A single failing site points at that site's certificate. ### Is it safe to click Proceed? On a site you own and are debugging, yes. Anywhere else, no — the browser cannot distinguish a misconfigured certificate from an active interception. ### How do I fix this on my own site? Read the NET::ERR_CERT_* code under the message, then fix that specific cause: renew for DATE_INVALID, serve intermediates for AUTHORITY_INVALID, reissue with the right hostname for COMMON_NAME_INVALID. ## Related - [All website error codes](https://lemwatch.com/errors) - [ERR_CERT_DATE_INVALID](https://lemwatch.com/errors/err-cert-date-invalid) - [ERR_CERT_AUTHORITY_INVALID](https://lemwatch.com/errors/err-cert-authority-invalid) - [ERR_CERT_COMMON_NAME_INVALID](https://lemwatch.com/errors/err-cert-common-name-invalid) - [ERR_SSL_PROTOCOL_ERROR](https://lemwatch.com/errors/err-ssl-protocol-error) - [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker) - [Your connection is not private on WordPress](https://lemwatch.com/errors/your-connection-is-not-private/in-wordpress) - [White screen of death on WordPress](https://lemwatch.com/errors/white-screen-of-death/in-wordpress)