Different SSL errors point to different root causes — treating them all as "the certificate is broken" wastes troubleshooting time.
Common errors decoded
- NET::ERR_CERT_DATE_INVALID: the certificate has expired, or the server’s system clock is wrong
- NET::ERR_CERT_COMMON_NAME_INVALID: the certificate doesn’t cover the exact domain/subdomain being visited (e.g. missing a www or wildcard match)
- NET::ERR_CERT_AUTHORITY_INVALID: usually an incomplete certificate chain, or a self-signed certificate
- SSL_ERROR_NO_CYPHER_OVERLAP: the server and browser can’t agree on a supported cipher/TLS version — often caused by disabling TLS 1.0/1.1 without enabling 1.2/1.3 correctly
Diagnosing systematically
- Note the exact error code, not just "SSL error"
- Check expiry date and domain coverage first — the two most common causes
- Use an SSL checker tool to validate the full chain and supported protocol versions
FAQ
Why does the error differ between browsers for the same site?
Different browsers have different cached intermediate certificates and different minimum TLS version requirements, so a chain or protocol issue can surface inconsistently.