From NET::ERR_CERT_AUTHORITY_INVALID to mismatched SANs and expired chains, SSL errors break trust instantly. Use this workflow to identify the exact certificate fault and ship the right fix.
NET::ERR_CERT_AUTHORITY_INVALID — chain incomplete or self-signed.NET::ERR_CERT_DATE_INVALID — expired or not-yet-valid certificate.NET::ERR_CERT_COMMON_NAME_INVALID — hostname not in SAN list.SSL_ERROR_BAD_CERT_DOMAIN — same as above on Firefox/Safari.A valid certificate alone doesn't mean strong TLS. Audit your security headers (HSTS, CSP), redirect HTTP to HTTPS, and verify modern protocol versions (TLS 1.2+, ideally 1.3) are negotiated.
Run through these steps in order. Each step links to the right diagnostic tool.
Usually an incomplete chain. Some clients carry intermediates in their trust store; others don't. Always serve the full chain.
Modern browsers ignore CN and validate against Subject Alternative Names. Every hostname you serve must be in the SAN list.
It covers a single subdomain level. *.example.com covers www and api, but not deeper.api.example.com.
30 days before expiry is safe. Automate it — manual renewal is the single biggest cause of preventable outages.
Monitor it continuously
Save this check, get alerts on changes, and track multiple domains in one dashboard.