Use a certificate from a publicly trusted authority
Why it matters
The certificate was issued by an authority that browsers and operating systems do not trust, so visitors see a security warning. This happens with private company CAs, distrusted CAs and certificates issued by a test environment.
The fix
- Check the issuer (command below). A private or internal CA, or a staging CA such as Let's Encrypt's staging environment, is not trusted by browsers.
- Request a certificate for the host from a public CA (Let's Encrypt, or a commercial CA) and install it with its intermediate certificates.
- If the issuer is a public CA that browsers have stopped trusting, replace the certificate with one from a currently trusted CA.
- Reload the web server and confirm the new issuer.
bash
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -issuer -subject The examples use example.com. Replace it with your own domain.
Related
- Reported by the certificate chain and expiry check
- Renew the expired TLS certificate
- Fix a certificate that is not valid yet
- Renew the certificate before it expires
- Install a certificate that covers this hostname
- Replace the self-signed certificate with a trusted one
- Serve the full certificate chain
- Replace the expired intermediate certificate
- Re-issue the certificate with a stronger key
- Replace the certificate that uses a broken hash
- Fix the certificate that browsers reject
Scan your domain to see whether this applies to you.