What is a certificate warning?
When a browser connects to a site over HTTPS, the server presents a digital certificate during the TLS (Transport Layer Security) handshake. The browser checks that certificate before it trusts the connection. If any check fails, it stops and shows a full-page warning instead of the site, such as "Your connection is not private" in Chrome or "Warning: Potential Security Risk Ahead" in Firefox. Chrome and Edge also show an error code, for example NET::ERR_CERT_DATE_INVALID, NET::ERR_CERT_COMMON_NAME_INVALID or NET::ERR_CERT_AUTHORITY_INVALID, which tells you which check failed.
What the browser checks
- Validity dates: the current date must fall between the certificate's start and end dates, or it is expired or not yet valid.
- Name match: the domain in the address bar must match a name listed in the certificate, or you get a name mismatch.
- Trusted issuer: the certificate chain must lead to a root certificate authority (CA) in the operating system or browser trust store. A self-signed certificate, or one from an unknown issuer, fails this check.
- Revocation: when checked, the certificate must not have been revoked by its CA.
Common causes, most likely first
| Warning | Likely causes | First check |
|---|---|---|
| Expired or not yet valid | Wrong system date or time zone (for example after a dead CMOS battery), or the site forgot to renew | Device date, time and time zone |
| Name mismatch | Typo or look-alike domain, a redirect, or a captive portal intercepting the request | URL spelling; finish the Wi-Fi sign-in page |
| Untrusted or self-signed issuer | Internal device such as a printer, router or management console using a self-signed certificate; outdated trust store; inspection proxy; attacker | Update the OS and browser; check proxy settings and installed root certificates |
| Warnings on many sites at once | Wrong clock, an intercepting proxy or security product, a malicious root certificate, or an on-path attack | Clock first, then the network path and proxy |
When a warning signals an attack
A certificate warning is often the only visible sign of an on-path (man-in-the-middle) attack, where someone intercepts traffic and presents a certificate the browser cannot validate. Be suspicious when warnings appear on large, well-known sites, only on one network such as public Wi-Fi, during sign-in, or when the certificate details name an unexpected issuer. Malware can also install its own root certificate so it can intercept traffic without warnings, so an unexplained root certificate in the trust store is a red flag. Some companies deliberately inspect encrypted traffic with a security gateway that re-signs certificates using a company root certificate; that is expected only if IT policy documents it.
Safe response
- Do not click through, and do not enter credentials or payment details.
- Check the device's date, time and time zone.
- Retype the address or open it from a known bookmark instead of a link.
- Test on another network (a phone hotspot) and on another device to see whether the problem follows the network or the device.
- Update the operating system and browser.
- Check proxy and VPN settings and installed root certificates, and scan for malware.
- On a managed device, report the site, time, network and exact error text to IT.
Sites that use HTTP Strict Transport Security (HSTS) do not offer a "proceed anyway" option at all.
Certificate warning on the CompTIA A+ exam
Certificate warnings are a browser symptom in Core 2 (220-1202) objective 3.4 on PC security issues, and objective 2.11 covers recognizing secure connections and valid certificates. If every site suddenly shows certificate errors on a PC that sat in storage or has a failing CMOS battery, check the date and time. If warnings appear only on coffee-shop Wi-Fi, think captive portal first, then an on-path attack. If a router or printer admin page shows a warning, it is probably using a self-signed certificate. Remember that a padlock means the connection is encrypted, not that the site is honest, and that clicking through warnings as a habit is never the right answer.