Most SSL warnings come from how the certificate is installed, not from the certificate itself. Find your browser's error below, check your site with our SSL Certificate Checker, and apply the fix.
Name mismatch (ERR_CERT_COMMON_NAME_INVALID)
The certificate doesn't cover the exact hostname in the address bar: for example it secures yourdomain.in but the visitor is on www.yourdomain.in, or a subdomain isn't covered. If your current product already allows the extra names, a free reissue adds them; otherwise you need a wildcard or multi-domain (SAN) product.
Incomplete certificate chain
The most common install mistake: the server sends your certificate but not the intermediate CA certificates, so some browsers and mobile devices don't trust it. Install the full chain; our download kit includes a fullchain file for this reason.
Expired certificate (NET::ERR_CERT_DATE_INVALID)
The validity period has ended. If your paid plan still has time left (any plan of a year or more), reactivate it free; otherwise renew. Certificates now last at most 200 days, so set up free expiry alerts. If the error appears on only one device, check that device's date and time: a wrong clock makes valid certificates look expired.
Mixed content warning
Your page loads over HTTPS but pulls some images, scripts or styles over plain http://. Update those references to https:// so the whole page is secure.
Not trusted (NET::ERR_CERT_AUTHORITY_INVALID)
A self-signed certificate, or one from an untrusted source, triggers a hard warning. Replace it with a certificate from a publicly trusted CA. If your certificate is from a trusted CA and you still see this, the chain is usually incomplete (see above).
The CA won't issue my certificate
Usually a CAA record that doesn't allow the CA (sectigo.com for Sectigo, Comodo and PositiveSSL; digicert.com for DigiCert, GeoTrust, Thawte and RapidSSL), broken DNSSEC, or a validation record that isn't visible from every network location. Check all three with the DNS, DCV & CAA Checker.
Still stuck?
Run your site through the SSL Certificate Checker to see the chain, names and expiry. If it still fails, open a support ticket with your domain.
Common questions
Why does it work in my browser but not on my phone?
Desktop browsers can sometimes fetch a missing intermediate certificate themselves; many phones and apps can't. Install the fullchain file.
My certificate expired sooner than a year. Why?
Certificates can now last at most 200 days. If your plan has time left, reactivate free.
Does clearing my browser cache fix SSL errors?
Rarely. Check what the server actually sends with the SSL Certificate Checker first.