Fix the certificate that browsers reject on nginx

Why it matters

The certificate or its chain fails verification for a reason other than expiry, a wrong name or a missing authority, so browsers refuse it. Without a certificate at all, HTTPS cannot work.

The fix

1. Check that the server block listens on 443 with ssl enabled and has both ssl_certificate (full chain) and ssl_certificate_key (the matching private key).
2. Test the configuration and reload nginx.

server {
    listen 443 ssl;
    server_name example.com;
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
}

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Renew the expired TLS certificate
• Fix a certificate that is not valid yet
• Renew the certificate before it expires
• Install a certificate that covers this hostname
• Replace the self-signed certificate with a trusted one
• Use a certificate from a publicly trusted authority
• Serve the full certificate chain
• Replace the expired intermediate certificate
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash