Fix the certificate that browsers reject

Why it matters

The certificate or its chain fails verification for a reason other than expiry, a wrong name or a missing authority, so browsers refuse it. Without a certificate at all, HTTPS cannot work.

The fix

1. Read the finding detail for the verification error, then run the command below to see exactly what the server sends.
2. If the server sends no certificate, HTTPS is not set up on this host. Obtain a certificate (certbot or your hosting platform) and enable the 443 listener.
3. If the chain is broken, serve the full chain. If the key does not match the certificate, install the matching pair. If the certificate was revoked, request a new one.
4. Reload the web server and run the command again until verification succeeds.

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>&1 | grep -E "Verify return code|verify error|depth"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Renew the expired TLS certificate
• Fix a certificate that is not valid yet
• Renew the certificate before it expires
• Install a certificate that covers this hostname
• Replace the self-signed certificate with a trusted one
• Use a certificate from a publicly trusted authority
• Serve the full certificate chain
• Replace the expired intermediate certificate
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash