Error certificate authority not found

1. SSH connected to server as root, generated certificate signing request with openssl:

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

Common Name: *.domain.tld
The rest: Country/State/Org/ …

2. Processed Comodo EssentialSSL Wildcard (got from NameCheap) with the generated CSR > received certificate bundle by email including the 1 signed cert file and 3 cert authority files.

3. VestaCP admin > Web > SSL Support > Copy pasted signed certificate into «SSL Certificate» box, Copy pasted private key into «SSL Key» box > Save

That causes Error: certificate authority not found.

Help appreciated.

SOLUTION:

xD gotta copy paste the certificate authority info into the certificate authority box (the third box in the «SSL Support» section)

Comodo (or other SSL provider) will email you a bundle zip file containing 4 files, 1 of them (ex. STAR_domain_tld.crt) is the signed certificate to be copy pasta’d into the first box like I mentioned I did. And then the 3 remaining .crt files (ex. AddTrust…, COMODORSAAddTrustCA, COMODORSADomainValid…) should be copy pasta’d into that third box (create a new text file and copy paste the 3 certs into there first, then mass copy paste from the summed text).

Like:

-----BEGIN CERTIFICATE-----
....
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
.....
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
......
-----END CERTIFICATE-----

I have installed SSL on my VestaCP , but browser says my site is insecure, why this is happening on this my site?

Installing an SSL Certificate in Vesta CP is quite easy. However, missing certificates and improper installation may lead to errors on websites.

At Bobcares, we often get requests from our customers to set up VestaCP SSL as part of our Server Management Services

Today, we’ll see how our Support Engineers set up VestaCP SSL and fix related errors.

How we install an SSL Certificate in Vesta CP

Usually, site owners installing an SSL certificate on their website to increase their confidentiality. While installing an SSL Certificate, they promise their customers that they will never compromise their details with anyone.

So, this is an unavoidable factor for their business.

Now, Let’s see how our Support Engineers install an SSL Certificate in Vesta CP.

1. Before going to the SSL installation, we make sure that we have all the files that are provided by the SSL providers. It includes,

1. SSLCertificateFile.
2. SSLCertificateKeyFile.
3. SSLCACertificateFile.

2. Then, we log into the Vesta CP control panel.

3. We go to WEB, click the domain we want to install an SSL certificate and click on the Edit button.

4. On the next page, we locate SSL Support tab and enable it.

5. Next, we paste the certificate, Private Key and CA Bundle files into the corresponding fields.

6. Finally, we click the Save button.

That’s it!

How we fixed errors while installing VestaCP SSL

From our experience in managing servers, we’ve seen customers facing problems with the VestaCP SSL setup. Now, Let’s take a closer look at how our Support Engineers fixed some common problems.

Improper installation SSL​ certificates

Installing an SSL for a domain is very easy. Also, when a control panel is installed on the server, it becomes very easy. Customers can often face problems when pasting certificates into the SSL field of VestaCPls. The ones might be confused about what they have to paste on.

So, definitely, the certificate will not be installed. It will throw an error using installation.

Therefore, our Support Engineers ensure that all the certificates provided by the SSL provider are correct. If not, we will do the installation once again on behalf of the customer.

Missing certificates

Recently, one of our customers contacted us with a problem while installing the SSL via VestaCP. When he tried to install an SSL Certificate, he continued to receive the following error message

Error: root or/and intermediate cerificate not found
Error: certificate authority not found

Normally, this happens when the customer leaves the field SSL Certificate Authority / Intermediate as empty.  But, due to some reason, VestaCP does not allow to install the SSL without this field.

So, our Support Engineers installed the bundled keys,

For GoDaddy, it should look like gd_bundle.crt file which received with the certs.

[Having trouble while installing SSL on VestaCP? We’ll fix it for you.]

Conclusion

In short, installing VestaCP SSL needs much attention because missing certificates and improper installation will result in SSL failure. Today, we saw how our Support Engineers install SSL on Vestacp and fix related errors.

var google_conversion_label = «owonCMyG5nEQ0aD71QM»;

При открытии сайтов в браузере иногда возникают ошибки – домен в адресной строке выделяется красным с зачеркиванием или ресурс вообще не открывается. Типовая причина скрывается в сбоях работы сертификата SSL. Исправить их может только администратор сайта, но перед обращением к нему стоит проверить собственный компьютер.

Что такое SSL

Текущие тенденции сайтостроения предполагают высокую безопасность соединения пользователя с веб-ресурсом. Это необходимо для защиты персональных данных, секретных номеров банковских карт и информации о проводимых сделках. Организуется безопасность подключением протокола шифрования Secure Sockets Layer (сокращенно SSL).

Особенности сертификата:

1. Сертификат выпускается доверенным центром Certification Authority (CA).
2. После выдачи он подключается к домену средствами провайдера хостинга.
3. Срок его действия ограничен 1 годом, после чего требуется продление.

Работа сайта возможна и без SSL, но поисковые системы «не доверяют» таким ресурсам и помечают их в браузере как неблагонадежные. Поэтому лучше разобраться, как решить проблему с защитой и полноценно пользоваться протоколом HTTPS. Сертификат актуален на сайтах, где присутствует регистрация, предлагается покупка товаров или онлайн-оплата различных сервисов.

При появлении любых сомнений в исправности защиты регистрироваться на сайте или вводить ранее выданные логин и пароль не рекомендуется. Тем более не стоит осуществлять онлайн-оплату с банковских карт или электронных кошельков, ведь не исключено, что проблема возникла из-за взлома ресурса злоумышленниками.

Причины появления ошибок SSL

Существует всего две причины, почему браузер отображает ошибку сертификата SSL со стороны сервера. Первая заключается в окончании срока активации, вторая – это покупка сертификата у поставщика без достаточных полномочий для выдачи «полноценной защиты». Например, виной может быть выбор самоподписанного сертификата, лишь эмулирующего работу реального протокола.

Остальные проблемы обычно скрываются на локальном компьютере:

1. Произошел сброс системного времени.
2. Неправильно настроена антивирусная программа.
3. Сбоит браузер или установленное расширение.
4. Срабатывает вредоносный скрипт.

Чтобы выяснить настоящую причину, пользователю браузера рекомендуется проверить все перечисленные факторы. При том же заражении компьютерными вирусами возможно проявление сразу нескольких симптомов – от изменения текущего времени и блокировки антивирусом до подключения перенаправления страниц в браузере и других неприятностей.

Изредка встречаются ситуации, когда проблема возникла со стороны администратора, если он ошибся при подключении нового сертификата или забыл продлить его действие. Обычно такие неполадки устраняются быстро, потому что после активации сайт проверяется и, в случае неработоспособности сертификата, проводится повторное подключение вплоть до получения положительного результата.

Время и дата

Сертификат SSL имеет четко обозначенный срок действия с датой активации и деактивации. Такой подход отчасти дает дополнительную защиту, потому что в случае технического сбоя в системных часах компьютера сайты перестают открываться. Сброс времени обычно происходит «назад», на дату изготовления материнской платы, на что и реагирует система.

Варианты исправления ситуации:

1. Вручную внести корректную дату и время, после чего обновить страницу в браузере.
2. Воспользоваться функцией синхронизации через интернет, встроенной в Windows.
3. Заменить батарейку на памяти BIOS. При первом запуске ПК нужно внести корректные данные.

Каждый раз после изменения времени рекомендуется ручное обновление страницы или перезапуск браузера. Такой шаг активирует повторное соединение с сервером и позволяет зайти на сайт «с нуля», но уже с правильным временем, соответствующим сроку действия сертификата SSL (после активации и до ее завершения).

Настройки антивируса и брандмауэра

Программы для защиты компьютера от вирусов и хакерских атак иногда блокируют и «полезные» соединения, например, определенные домены или сразу весь протокол HTTPS, используемый при подключении сертификата SSL. Большинство антивирусов и брандмауэров проверяют его работу, и это становится причиной блокировки сайта как «злоумышленника, пытающего украсть данные».

Варианты исправления ситуации:

1. Отключить режим «проверка протокола HTTPS». После этого зайти на сайт заново.
2. Полностью выключить антивирусную программу. Перезагрузить ПК, открыть страницу.
3. Сбросить настройки брандмауэра. Опять проводится перезапуск компьютера и веб-ресурса.

Функция временного отключения имеется в любой защитной программе, даже интегрированной в операционную систему Windows. Но это не гарантирует полную деактивацию приложения. В этом случае разобраться в ситуации поможет открытие сайта на другом компьютере или запуск безопасного режима (актуально для проводного подключения к интернету).

Браузер и операционная система

Наличие проблемы с браузером проще всего определить открытием сайта на другом устройстве или в другой программе. Иногда решение заключается в банальном обновлении версии приложения до актуальной. То же относится к операционной системе, если используется интегрированный браузер вроде Edge. Пакеты обновлений для того и выпускаются, чтобы устранять неполадки в ПО.

Варианты исправления ситуации:

1. Полностью очистить историю браузера вместе с кэшем и другими данными.
2. Временно отключить все ранее установленные и активные расширения.
3. Переустановить программу после ее полной деинсталляции.

Остается еще один вариант – сбросить настройки браузера до состояния «по умолчанию». Способ аналогичен переустановке, но экономит время. Правда, он неэффективен, если проблема возникла из-за сбоя в одном из служебных файлов программы. Отдельное внимание стоит уделить расширению, выполняющему функции антивирусной защиты, ведь оно часто блокирует даже безопасное соединение.

Заражение компьютерными вирусами

Выдачей ошибки SSL браузер, вероятно, предупреждает о попытке его подмены, переадресации на сайт-клон или иной угрозе. В это случае рекомендуется провести полную проверку компьютера на наличие вирусов. Если присутствуют другие признаки заражения, стоит скачать парочку программ со свежими антивирусными базами (например, CureIt).

Варианты исправления ситуации:

1. Временно отключить все программы из автозагрузки.
2. Провести очистку диска от временных файлов.
3. Перезагрузить компьютер после предыдущих шагов.

Выполняются перечисленные действия программами типа CCleaner. Они дают прямой доступ как к автозагрузке операционной системе, так и к списку расширений установленных браузеров. Также в таких программах обычно есть функция удаления ненужных системных файлов, в которых запросто может быть тело компьютерного вируса.

Если предложенные способы устранения ошибки SSL не помогли, остается ждать, пока проблему устранит администратор, или воспользоваться любым другим тематическим сайтом с аналогичным контентом.

Even if you do have an SSL certificate installed on your website, your users may run into the NET::ERR_CERT_AUTHORITY_INVALID error. Despite its intimidating name, the invalid certificate authority error isn’t something you should panic about.

Simply put, your browser doesn’t recognize the validity of your certificate. To keep you ‘safe’ it displays this error, so you’re aware that there’s something fishy going on. As the website owner, though, there are a lot of things you can do to fix the problem.

In this tutorial, we’ll talk about what the error message means, and how it looks in different browsers. Then we’ll teach you how to fix the NET::ERR_CERT_AUTHORITY_INVALID error by covering all of its likely causes.

Let’s get to work!

What Is NET::ERR_CERT_AUTHORITY_INVALID Error?

As the name of the error implies, this problem pops up when your browser can’t verify the validity of your website’s SSL certificate. If you haven’t set up a certificate or are using HTTP for your website, which isn’t recommended, you shouldn’t run into this error.

Generally speaking, there are three primary causes for the invalid certificate authority error. Let’s break down each one in turn:

1. You’re using a self-signed SSL certificate. Using a self-signed certificate can save you money, but since browsers can’t verify its validity, your visitors may run into the error in question. Browser warnings can scare a lot of users away, so we recommend against this approach.
2. Your certificate has expired. SSL certificates expire as a security precaution. How long your certificate lasts can vary, but at some point, you’ll need to renew it or automate the renewal process (some authorities and web hosts enable you to do this easily).
3. The certificate comes from a non-trusted source. Just as with self-signed certificates, if browsers can’t verify the authority that generated your certificate, you’ll see an error.

Remember that every time a user visits a website with an SSL certificate, their browser needs to validate and decrypt it. If there are any errors during that process, they’ll see a warning.

In a lot of cases, browsers will actively prevent users from accessing the website in order to protect them. This often comes in the form of the “Your Connection is Not Private” error. As you might imagine, that’s a huge problem if it occurs on your own site.

Sometimes, you may run into the NET::ERR_CERT_AUTHORITY_INVALID error due to local configuration settings. Throughout the next sections, we’ll show you the many faces this error can take and then we’ll talk about how to troubleshoot it.

When you see a NET::ERR_CERT_AUTHORITY_INVALID error message pop up, you might be concerned 😬. Despite its intimidating name, this invalid certificate authority error isn’t cause for alarm. 😅 Learn how to fix it in a few simple steps. ⬇️Click to Tweet

What Are the NET::ERR_CERT_AUTHORITY_INVALID Error Variations?

The way an error appears can vary a bit, depending on what browser you’re using. Your operating system and your certificate’s configuration can also play a role in the different error messages that appear.

With that in mind, let’s take a look at the most common variations of the NET::ERR_CERT_AUTHORITY_INVALID error, browser by browser.

• Your connection is not private
• Warning: Potential Security Risk Ahead
• Your connection isn’t private
• This Connection Is Not Private

Google Chrome

When you run into this error in Chrome, the browser will tell you right away that your connection isn’t private. Since the browser doesn’t recognize your certificate’s validity, it can’t encrypt your data.

That means if you proceed, you do so at your own risk. Here’s what the error message looks like:

Attackers might be trying to steal your information from domain.com (for example, passwords, messages, or credit cards).

Common variations of this error in Chrome include the following codes:

• NET::ERR_CERT_AUTHORITY_INVALID
• NET::ERR_CERT_COMMON_NAME_INVALID (This occurs when the certificate does not match the domain)
• NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM
• NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED
• NET::ERR_CERT_DATE_INVALID
• SSL CERTIFICATE ERROR

In every case, Chrome pinpoints the source of the error within the certificate. The browser lets you proceed to the website if you choose, but it warns you against doing so.

Mozilla Firefox

Firefox doesn’t waste any time in telling you that you may have run into a potential security risk. What’s more, this browser does a better job than Chrome when it comes to explaining the potential causes and telling you not to panic.

Here’s how the primary error message reads:

Firefox detected an issue and did not continue to domain.com. The website is either misconfigured or your computer clock is set to the wrong time.It’s likely the website’s certificate is expired, which prevents Firefox from connecting securely. If you visit this site, attackers could try to steal information like your passwords, emails, or credit card details.

That variation of the error doesn’t include a specific code, though. In most cases, the screen will include one of the following codes as well:

• SEC_ERROR_UNKNOWN_ISSUER
• SSL_ERROR_RX_MALFORMED_HANDSHAKE
• MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE
• SEC_ERROR_REUSED_ISSUER_AND_SERIAL

If you see an error code like one of the above, make sure to copy it down somewhere. That is the browser’s way of telling you where things went wrong. In our experience, a simple search for a specific error code is often enough to help you find a quick solution.

Microsoft Edge

The Microsoft Edge error message you see below should look familiar. It’s almost identical to the message Chrome displays, right down to the included code:

The error can also come in different flavors, including the following:

• DLG_FLAGS_SEC_CERTDATE_INVALID
• DLG_FLAGS_INVALID_CA
• DLG_FLAGS_SEC_CERT_CN_INVALID
• NET::ERR_CERT_COMMON_NAME_INVALID
• ERROR CODE: O

Just as with Chrome, these error messages give you some insight into what’s at the root of your NET::ERR_CERT_AUTHORITY_INVALID error.

Safari

If you’re a Safari user, you’ll run into a variation of the ‘this connection is not private’ error, which lets you know there’s a problem with the website’s certificate and encryption. Here’s what the message says:

This website may be impersonating “domain.com” to steal your personal or financial information. You should go back to the previous page.

That particular error is due to an expired certificate. As we mentioned before, expired certificates are one of the most common causes of the NET::ERR_CERT_AUTHORITY_INVALID error.

How to Fix the NET::ERR_CERT_AUTHORITY_INVALID Error (9 Methods)

Now that you know what it looks like across most major browsers, it’s time to check out how to solve the NET::ERR_CERT_AUTHORITY_INVALID error. Earlier, we talked about its most common causes. However, we also mentioned that your local configuration can trigger it in some cases.

That means there are a lot of potential solutions to this issue. To keep things simple, we’ll start by tackling the three most common culprits, i.e. expired, self-signed, and ‘untrustworthy’ certificates. Then we’ll move on to more general solutions.

Here’s what we’ll cover:

1. Run an SSL Server Test

If you installed your SSL certificate shortly before the error began appearing, something may have gone wrong during the setup process. That can often happen if you installed the certificate manually, instead of through your web host.

The easiest way to check and see if your certificate is properly installed is by using an SSL check tool, such as the one offered by Qualys SSL Labs. This particular tool is free to use.

All you have to do is enter the domain where the error is popping up, and click on the Submit button:

Now, wait a couple of minutes while the results come up. Ideally, you should get an A+, with perfect scores for all your certificates:

If you don’t get a perfect score, scroll down to the list of certificates the tool shows you. There should be a section that tells you whether your certificate is trusted or not. If the tool gives you a negative result, then you’ll need to install a certificate from a trusted source instead.

2. Get a Certificate from a Valid Authority

There’s no excuse to use a self-signed certificate these days. If cost is the only factor, you can get a free certificate from Let’s Encrypt. Since it’s a valid authority, every browser will recognize your certificate’s validity:

If you’re a Kinsta user, we can help you set up your free Let’s Encrypt certificate in a matter of click through your MyKinsta dashboard:

For some websites, however, you’ll need more than a free certificate. Free certificates need to be renewed often, which can be a chore. Premium certificates offer more perks, such as insurance in the case of data breaches, encryption for multiple domains, and more.

For ecommerce sites, in particular, it can be worth it to pay for a premium SSL certificate. If you do buy a certificate, make sure it’s from a valid authority, in order to avoid running into the NET::ERR_CERT_AUTHORITY_INVALID error.

3. Renew Your SSL Certificate

SSL certificates need to be renewed every so often for security purposes. The renewal process verifies your domain’s ‘identity’, and without it, certificates would lose some of their validity. Free certificates from Let’s Encrypt renew every 90 days, whereas paid options have longer lifespans.

Check Out Our Video Guide to Choosing The Best SSL Certificate For Your Site

When the term is up, you’ll need to renew your certificate manually if your web host doesn’t handle that for you. In any case, Let’s Encrypt will contact you when your certificate is about to expire, so you can renew it ahead of time. Depending on which web host you use, however, you might not get access to renewal options through your control panel.

If you have access to your server, you can use the Certbot tool to install and renew SSL certificates through the command line.

Once you renew your SSL certificate, try loading your website again to see if the NET::ERR_CERT_AUTHORITY_INVALID error persists.

4. Try Reloading the Page (Or Using Incognito Mode)

If neither of the above fixes worked, it’s time to start troubleshooting directly from your computer.

In many cases, the NET::ERR_CERT_AUTHORITY_INVALID error disappears on its own when you try to reload the page. It only takes a second to do so, so it doesn’t hurt to try.

If the error persists across multiple reloads, we recommend that you try accessing the website using an ‘incognito mode’ if your browser offers that option:

If the website loads fine in incognito mode, that means the error is likely caused by your browser attempting to load an outdated cached version of the page. That gives you enough information to tackle the problem directly (as we’ll see in the next section).

5. Clear Your Browser’s Cache and Cookies

If switching your browser to incognito mode made the NET::ERR_CERT_AUTHORITY_INVALID error go away, then the issue is probably related to your browser’s cache.

Clearing your cache and cookies is easy, but the process varies depending on which browser you’re using. Below you can find instructions for clearing the cache in all the major browsers:

• How to Clear Browser Cache for Google Chrome
• How to Clear Browser Cache for Mozilla Firefox
• How to Clear Browser Cache for Safari
• How to Clear Browser Cache for Internet Explorer
• How to Clear Browser Cache for Microsoft Edge
• How to Clear Browser Cache for Opera

Another solution can be to try and force refresh your website specifically, so you don’t have to delete your entire cache. Force refreshing sometimes doesn’t work, however, so clearing your cache is our recommended solution.

6. Sync Your Computer’s Clock

One of the most common causes for the NET::ERR_CERT_AUTHORITY_INVALID is because your computer has the wrong date or time set. To clarify, errors with your device’s clock can interfere with your browser’s ability to verify a website’s certificate.

The good news is that if this is the problem, it’s an easy fix. If you notice a discrepancy between your computer’s clock and the current time, you can adjust it in seconds. Exactly how you do this will depend on which Operating System (OS) you’re using.

Windows

Go to the system tray and right-click on your computer’s time, then select the option that says Adjust date/time:

A settings window will appear. Look for the option that reads Sync now under Synchronize your clock, and click on it: Syncing your computer clock.

If you have an internet connection, Windows will make sure the date and time are correct. To avoid this issue in the future, we recommend that you enable the Set time automatically option. This setting should ensure that your computer always has the correct time.

Mac

If you’re using macOS, the syncing process is also remarkably simple. All you have to do is follow these steps:

1. Select the System Preferences option within the Apple menu.
2. Click on the Date & Time icon.
3. Turn on the Set date & time automatically option.

Before you close the settings screen, swing by the Time Zone tab and make sure you’re using the correct time zone. Once that’s done, you can check to see if the NET::ERR_CERT_AUTHORITY_INVALID error still persists.

7. Try Using a Different Network

In some cases, the NET::ERR_CERT_AUTHORITY_INVALID error pops up when you’re using a public network, such as the ones you can find in coffee shops or tourist spots. These networks often don’t route traffic securely, which can trigger the error.

If you’re using a public network for your computer, we recommend trying to access your website through your smartphone using its mobile data. Your goal here is to determine whether the original network was causing the problem.

If the error disappears when you’re using mobile data, then you know you need to switch networks. Another option to protect your privacy if you regularly use public internet access is to sign up for a Virtual Private Network (VPN).

A good VPN service will help protect your data even if you’re using an unsecured point of access. You will need to pay if you want to use a quality VPN service, but the expense is well worth it if you’re always on the move.

8. Disable Your VPN or Antivirus Software

If you’re already using a VPN and you run into the NET::ERR_CERT_AUTHORITY_INVALID error, the service itself may be triggering it.

Another common culprit is antivirus software. After you’ve tried everything else, we recommend that you temporarily turn off your VPN and disable your antivirus software. Then try accessing your site again and use force refresh to make sure it’s not loading from your browser’s cache.

If the error is gone, try re-enabling both services, one at a time, and see if you get the invalid certificate notification once more. This will let you know which is at fault. You may then choose to try and update the software, contact its support team for help, or look for an alternative solution.

9. Wipe Your Computer’s SSL State

Your computer keeps cached copies of certificates from websites you visit on a temporary basis, so it doesn’t have to run through the entire verification process each time you access them.

You can think of your SSL state as a cache, only for certificates. Just as with your cache, you can wipe your computer’s SSL state when you run into invalid certificate authority errors.

In Windows, you can do this by accessing the Internet Options menu from your control panel, and moving to the Content tab:

Click on the button that says Clear SSL state, close the window, and try reloading your website.

If you’re using macOS, and have accepted an untrusted certificate in the past, you may need to delete the certificate exception created for it from your Mac Keychain.

To do this, click on the Finder icon, followed by Go > Utilities > Keychain Access:

Under the Category section, select Certificates. Any untrusted certificates should have a red ‘X’ under their names. To delete them, click on Edit at the top of the screen, followed by Delete.

The NET::ERR_CERT_AUTHORITY_INVALID might look scary 😱, but this guide will give you the tools you need to tackle it across browsers 💪Click to Tweet

Summary

The NET::ERR_CERT_AUTHORITY_INVALID error can take a while to troubleshoot if you’re unable to determine what’s causing it. Plus, if your visitors are seeing it as well, that can harm both your traffic and your reputation.

The good news is that most fixes take little time to implement. You’ll want to start by making sure your SSL certificate is up to date and valid, then perform some basic troubleshooting tasks such as reloading the page and clearing your browser’s cache.

After that, you can move on to more involved fixes, like wiping your SSL state and running an SSL server test.