TLS certificate errors: understand the browser warning

A TLS certificate warning means the browser could not validate a protected connection to the site in the address bar under its security rules. The causes differ: a wrong name, invalid dates, an untrusted chain or something unusual on the network. Read the exact error before acting.

Host names and dates

The certificate must cover the host name you requested. A certificate for example.com does not necessarily cover www.example.com; the owner must include the names it uses. A warning also appears if the certificate has expired or is not yet valid. Before blaming the server, check your device’s date, time and time zone. A badly set clock can make valid dates appear wrong.

Do not enter a password after a host-name mismatch warning. A typing error might lead to another server, while a configuration error can cause a site to serve the wrong certificate. Inspect the whole host name rather than a familiar-looking fragment.

Issuer and trust chain

The browser builds a chain from the site certificate to a trusted authority. A self-signed certificate, missing intermediate certificate or unknown issuer can break this check. A managed workplace network may set its own trust policy, but on a personal device you should not install a random root certificate suggested by a pop-up. That changes trust for many sites, not just the one being visited.

A public server should provide a suitable certificate chain for its names. If it works in one browser but fails in another, compare browser versions, trust stores and network conditions. The difference is a reason to investigate, not permission to disable TLS verification.

Safe steps for a visitor

Open the site from an official bookmark or type its address, confirm the device clock, and try another trusted network. If only one site still fails, report the exact URL, browser message and time to its owner. On public Wi-Fi, complete any normal network sign-in first; do not accept a certificate for an unrelated site just to get access.

Until the cause is clear, do not bypass the warning for email, banking or other sensitive actions. HTTPS protects a connection only after validation succeeds. RFC 8446 specifies TLS 1.3. The site information tool may provide technical context, but a third-party test cannot override your browser’s warning.