How to Fix SSL Certificate Errors

How SSL/TLS Works

When a browser connects to your site over HTTPS, it performs a TLS handshake. During this process, the server presents its certificate, the browser verifies the certificate is valid, not expired, issued by a trusted authority, and matches the requested domain. If any check fails, the browser shows an error.

Error 1: Certificate Has Expired

This is the most common SSL error. Certificates have a fixed validity period (typically 90 days for Let's Encrypt, 1 year for paid certificates). When the certificate expires, every visitor sees a full-page browser warning.

Fix: Renew the certificate immediately. If you use Let's Encrypt, ensure your auto-renewal cron job (via Certbot or similar) is running. Most hosting platforms (Cloudflare, Vercel, Netlify) handle renewal automatically — check that the automation has not broken.

Prevent: Set up uptime monitoring with SSL expiration alerts. CheckFast can notify you days before a certificate expires.

Error 2: Certificate Name Mismatch

This happens when the domain in the URL does not match any of the domains listed in the certificate. For example, the certificate covers www.example.com but the user visits example.com (without www).

Fix: Reissue the certificate to include all domain variants. Use a SAN (Subject Alternative Name) certificate that covers both example.com and www.example.com. A wildcard certificate (*.example.com) covers subdomains but does not cover the bare domain — you still need the bare domain in the SAN.

Error 3: Incomplete Certificate Chain

Browsers need the full chain from your certificate up to a trusted root CA. If intermediate certificates are missing, the browser cannot verify the chain and shows an error. This is especially common when manually installing certificates on Nginx or Apache.

Fix: Download the intermediate certificate bundle from your CA and concatenate it with your server certificate. In Nginx, the ssl_certificate directive should point to a file containing your cert followed by the intermediates. Use the CheckFast SSL Checker to verify the full chain is served correctly.

Error 4: Mixed Content

Mixed content occurs when an HTTPS page loads resources (images, scripts, stylesheets) over HTTP. Browsers block active mixed content (scripts, iframes) entirely and may show warnings for passive mixed content (images).

Fix: Update all resource URLs to use HTTPS or protocol-relative URLs. Search your codebase for http:// and replace with https://. Add the Content-Security-Policy: upgrade-insecure-requests header as a safety net. Check the browser console for mixed content warnings, or use our SEO Auditor to scan for them.

Error 5: Self-Signed Certificate

Self-signed certificates are not trusted by browsers because they are not issued by a recognized Certificate Authority. While fine for local development, they should never be used in production.

Fix: Replace with a certificate from a trusted CA. Let's Encrypt provides free certificates that are trusted by all major browsers. For most sites, there is no reason to use a self-signed certificate in production.

Error 6: TLS Version Too Old

TLS 1.0 and 1.1 are deprecated and disabled in modern browsers. If your server only supports these older versions, browsers will refuse to connect.

Fix: Configure your server to support TLS 1.2 and TLS 1.3. Disable TLS 1.0 and 1.1. In Nginx, set ssl_protocols TLSv1.2 TLSv1.3;

Prevention Checklist

• Automate certificate renewal (Certbot, managed hosting)
• Monitor expiration with alerts set at 14 and 7 days
• Always install the full certificate chain
• Test after every renewal using an SSL checker
• Enforce HTTPS with HSTS headers
• Scan for mixed content after any deployment