Your SSL certificate is installed, but browsers show "not trusted" or "connection is not private". Users leave, and search engines may mark the site as insecure. This is a common and fixable issue. This guide explains why your SSL certificate is not trusted and how to fix it.
What "not trusted" means
Browsers trust certificates issued by recognized Certificate Authorities (CAs). If the certificate is not issued by a trusted CA, or the chain is broken, the browser shows a warning.
Common messages:
— "Your connection is not private";
— "Certificate not trusted";
— "NET::ERR_CERT_AUTHORITY_INVALID";
— "SSL certificate problem".
These warnings mean the browser cannot verify the certificate.
Why trust matters
Trust affects:
— user experience;
— conversions;
— SEO;
— security.
If users see warnings, they leave. Search engines may mark the site as insecure, affecting rankings.
Reason 1: self-signed certificate
The most common cause. Self-signed certificates are not issued by a trusted CA, so browsers do not trust them.
What to check:
— who issued the certificate;
— is it self-signed;
— is it from a recognized CA.
The fix: use a certificate from a trusted CA. Let's Encrypt is free and trusted.
Use SSL lookup to check the issuer and chain.
Reason 2: incomplete chain
If the intermediate certificate is missing, browsers cannot verify the chain.
What to check:
— is the chain complete;
— are intermediates installed;
— does the server serve the full chain.
The fix: install the intermediate certificate and configure the server to serve the full chain.
Reason 3: domain mismatch
If the certificate does not cover the domain, browsers show a warning.
What to check:
— does the certificate cover the domain;
— does it cover www and non-www;
— does it cover subdomains.
The fix: use a certificate that covers the domain and its variants.
Reason 4: expired certificate
An expired certificate is not trusted.
What to check:
— expiry date;
— auto-renewal;
— monitoring.
The fix: renew the certificate and set up auto-renewal.
Reason 5: root CA not trusted
If the root CA is not in the browser's trust store, the certificate is not trusted.
What to check:
— who is the root CA;
— is it trusted by browsers;
— is it outdated.
The fix: use a certificate from a widely trusted CA.
How to diagnose trust issues
A practical sequence:
— check the issuer;
— check the chain;
— check domain coverage;
— check expiry;
— check root CA;
— test in different browsers.
If the certificate is self-signed or the chain is broken, fix it. For a broader audit, SEO audit can help verify SSL, HSTS and security in one place.
How to fix trust issues
Fix steps:
— use a trusted CA;
— install the full chain;
— ensure domain coverage;
— renew before expiry;
— use a trusted root;
— test after changes.
FAQ
Why is my SSL certificate not trusted?
Most often because it is self-signed, the chain is incomplete, the domain does not match, it is expired, or the root CA is not trusted.
Does an untrusted certificate affect SEO?
Yes. Users leave, and search engines may mark the site as insecure, affecting rankings.
What is a self-signed certificate?
It is a certificate not issued by a trusted CA. Browsers do not trust it.
How do I fix an incomplete chain?
Install the intermediate certificate and configure the server to serve the full chain.
Can a domain mismatch cause warnings?
Yes. If the certificate does not cover the domain, browsers show a warning.
What if the certificate is expired?
Renew it and set up auto-renewal. Expired certificates are not trusted.
How do I check the issuer?
Use an SSL checker to see the issuer, chain and expiry.
Are free certificates trusted?
Yes, if issued by a trusted CA like Let's Encrypt. They are widely trusted.
What if only some browsers show warnings?
Some browsers cache intermediates. Test in different browsers and check the chain.
How often should I check SSL?
After certificate changes and periodically as part of a security audit.
