Replace the self-signed certificate with a trusted one
Why it matters
A self-signed certificate is not vouched for by any authority browsers trust, so every visitor sees a security warning. Many API clients refuse the connection altogether.
The fix
- Get a certificate from a public certificate authority. Let's Encrypt is free and renews automatically with an ACME client such as certbot or acme.sh.
- Install the certificate with its intermediate certificates on the web server and reload it.
- If the server sits behind a CDN or proxy you control, let the CDN present the public certificate and keep a private certificate only between the CDN and your server.
- Confirm with the command below that the issuer is now a public authority.
bash
sudo certbot --nginx -d example.com # or --apache openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -issuer
The examples use example.com. Replace it with your own domain.
Related
- Reported by the certificate chain and expiry check
- Renew the expired TLS certificate
- Fix a certificate that is not valid yet
- Renew the certificate before it expires
- Install a certificate that covers this hostname
- Use a certificate from a publicly trusted authority
- Serve the full certificate chain
- Replace the expired intermediate certificate
- Re-issue the certificate with a stronger key
- Replace the certificate that uses a broken hash
- Fix the certificate that browsers reject
Scan your domain to see whether this applies to you.