The 'Your connection is not private' warning means the browser doesn't trust your site's SSL certificate. Three causes explain most cases: the certificate has expired, the certificate doesn't cover the address the site opens on (such as the www and non-www versions), or there is no valid certificate on the server at all. If you own the site, the fix is usually to renew or reinstall the certificate from your hosting panel, and it takes less than half an hour.
The cost to visitors is high. Most people who meet a red screen don't press 'Advanced' and continue; they go back. Enquiries and orders stop at that moment.
First: is it the site or the device?
Open the site from another device, ideally on mobile data. If the warning only appears on one computer, the problem probably isn't the site.
Device-side causes:
- The computer's date and time are wrong. If the clock is years behind, the browser treats every certificate as invalid.
- An antivirus program scans https traffic and inserts its own certificate.
- On a hotel, café or airport network, the login page hasn't been accepted yet.
If the warning appears on every device and network, the problem is the site. The steps below are for that case.
Read the error code
The warning page shows a small code. In Chrome it is usually one of these:
- NET::ERR_CERT_DATE_INVALID: the certificate has expired (or the device clock is wrong).
- NET::ERR_CERT_COMMON_NAME_INVALID: the certificate was issued for a different address. For example, it covers yourdomain.com but the site opens as www.yourdomain.com.
- NET::ERR_CERT_AUTHORITY_INVALID: the certificate isn't from a recognised authority. A self-signed certificate or a missing intermediate certificate.
- ERR_SSL_PROTOCOL_ERROR: the server configuration is broken or no certificate is installed.
In Firefox the same problems show up with codes like SEC_ERROR_EXPIRED_CERTIFICATE or SSL_ERROR_BAD_CERT_DOMAIN. The code tells you which section below to read.
An expired certificate
Free Let's Encrypt certificates are valid for 90 days and normally renew themselves before they expire. If you see the warning, automatic renewal broke somewhere. The causes we see most:
- The domain's DNS records were moved to another server or to a service like Cloudflare, so the host can no longer validate the domain.
- The site moved to new hosting, and the renewal job from the old server wasn't set up on the new one.
- A security plugin or server rule blocks the .well-known folder used for validation.
- The hosting plan changed and automatic SSL is switched off on the new plan.
The calendar is changing for paid certificates too. Under the shared rules of certificate authorities, new certificates issued from March 2026 are valid for at most 200 days, and that limit will keep shrinking over the coming years. The era of renewing by hand once a year is ending; automatic renewal is no longer optional.
Address mismatch: www, subdomains, old domains
A certificate only protects the addresses written on it. A certificate for yourdomain.com triggers the warning when the site opens as www.yourdomain.com. The fix is to reissue the certificate to cover both and redirect the site to one preferred address with a 301.
The same happens with subdomains. An address like shop.yourdomain.com needs its own coverage if it wasn't added to the main certificate. If you changed domains and redirect the old one to the new site, the old domain needs a valid certificate too; otherwise the warning appears before the redirect can run.
Fixing it from the hosting panel
On hosting with cPanel, open the 'SSL/TLS Status' page. Each domain shows its certificate status. The 'Run AutoSSL' button tries to issue the certificate again. If it fails, note the message; it usually says DNS points to another server.
On hosting with Plesk, you can reissue the Let's Encrypt certificate under the domain's 'SSL/TLS Certificates' section. Remember to tick both the www and non-www addresses.
If you use Cloudflare, check two things. If Cloudflare's SSL mode is 'Full (strict)', your server must also have a valid certificate; otherwise visitors see a 526 error. Switching to 'Flexible' may remove the warning, but it leaves traffic between Cloudflare and your server unencrypted. The lasting fix is to install a certificate on the server and stay on 'Full (strict)'.
After renewing, open the site in a private window and click the padlock. The certificate's expiry date appears. If it has jumped forward, the problem is solved.
If you can't fix it yourself, what to tell your host
Include three things in your support ticket: the error code, which address shows the warning (www or non-www), and your most recent change (DNS, migration, Cloudflare). Those three lines turn a reply that takes hours into one that takes minutes.
Making sure it doesn't happen again
Write down the certificate's expiry date and check once a month that automatic renewal works. A free uptime monitoring tool can also email you before a certificate expires. After any hosting move or DNS change, check the certificate first; we added this to the checklist in moving a site when changing hosting.
We explain what SSL does and why a free certificate is enough for most businesses in what is an SSL certificate, and domain routing in our DNS settings guide. If you'd rather not deal with certificate tracking, updates and backups yourself, our maintenance and support plan exists to run exactly these checks regularly.
Frequently Asked Questions
Can visitors press 'Advanced' and continue to the site?
Technically they usually can, but very few do, and those who do hesitate to fill in forms. Fix the certificate rather than expecting visitors to click through.
The warning only appears on my computer. What should I do?
Check the computer's date and time, temporarily turn off your antivirus's https scanning, and try another network. If the site opens fine on other devices, the problem isn't the site.
Does this warning affect my Google rankings?
A few hours usually leave no trace. If the warning lasts for days, visitors leave and Google may hit errors while crawling, which can reduce visibility over time.
Do free certificates cause this error more often?
No. Free certificates just renew more often. As long as automatic renewal works, there is no difference from a paid certificate.
Blog posts are for general information only and are not a substitute for legal, financial or technical advice.
