How to Fix ERR_CERT_AUTHORITY_INVALID in Chrome
What ERR_CERT_AUTHORITY_INVALID means
When you visit a website over HTTPS, the site presents an SSL/TLS certificate — a digital ID card that proves the site is really who it says it is. That ID card is only meaningful because it was signed by a certificate authority, an organization your browser already trusts. ERR_CERT_AUTHORITY_INVALID means Chrome looked at the certificate and could not follow the chain of trust back to any authority on its list.
Every browser ships with a store of trusted root certificates. When the server hands over its certificate, Chrome tries to build a path from it, through any intermediate certificates, up to one of those roots. If the path ends at the certificate itself (self-signed), at a private authority Chrome has never heard of, or at a gap where an intermediate certificate should be, Chrome cannot verify the site's identity. It shows the Your connection is not private warning with the code NET::ERR_CERT_AUTHORITY_INVALID and refuses to connect until something changes — either on your device, your network, or the site's server.
Common causes
- Self-signed or incomplete certificate on the server: the site uses a certificate that was not issued by a publicly trusted authority, or it is missing the intermediate certificate that links it to a trusted root.
- Wrong date and time on your device: when the clock is far off, valid certificates fail verification because Chrome thinks they were issued in the future or have expired.
- Antivirus HTTPS scanning or web shield: security software that inspects encrypted traffic re-signs connections with its own certificate, which Chrome does not trust.
- VPN, proxy, or corporate security software: tools like Zscaler, Palo Alto Networks, or Fortinet intercept HTTPS and present their own certificate authority — on a work computer this is usually intentional and managed by IT.
- Captive Wi-Fi portal interception: public Wi-Fi sign-in pages answer HTTPS requests with their own certificate until you sign in.
- Outdated operating system or root certificates: an old OS whose trusted root store no longer includes the authority that issued the site's certificate.
How to fix ERR_CERT_AUTHORITY_INVALID — step by step
Work through these fixes in order. Most cases are fixed by step 2, 4, or 5.
- Reload and rule out a temporary glitch Start with the fastest checks: press Ctrl + R (or Cmd + R on a Mac) to reload, then hold Ctrl (or Cmd) and click the refresh button for a hard refresh that skips the cache. If the warning appeared while the site was being worked on — a certificate being replaced or renewed — it can clear on its own within a few minutes. Try again in a few minutes before changing anything.
- Fix your date and time A wrong system clock is one of the most common causes. When your computer thinks it is 2019, every certificate issued after that date looks invalid, and Chrome cannot verify the chain. On Windows, right-click the clock in the system tray, choose Adjust date and time, turn on Set time automatically and Set time zone automatically, then click Sync now. On a Mac, open System Settings, go to General, then Date and Time, and make sure Set time and date automatically is on. If the clock keeps drifting back to the wrong date after every restart, the CMOS battery — the small coin-cell battery on the motherboard that keeps time while the PC is off — needs replacing.
- Test in an incognito window and disable extensions Press Ctrl + Shift + N (Cmd + Shift + N on a Mac) to open an Incognito window and load the site there. Incognito disables your extensions and ignores cached data, so if the warning disappears, an extension is interfering — ad blockers, privacy tools, and security extensions sometimes intercept connections in ways that break the certificate chain. Type chrome://extensions in the address bar, toggle all extensions off, then turn them back on one at a time, reloading the site after each, until the warning returns. The last one you enabled is the culprit.
- Pause antivirus HTTPS scanning and disconnect your VPN Security software that scans HTTPS traffic replaces the site's certificate with one it issues itself, which Chrome does not trust by default. Open your antivirus settings, look for HTTPS scanning, web shield, or encrypted connection scanning, and turn it off temporarily, then reload the page. If the warning goes away, the software was the cause — check the vendor's support pages for a setting that installs its scanning certificate into the system trust store, or leave scanning on but exclude your browsers. Also disconnect any VPN or proxy as a test: proxies that inspect traffic present their own certificates, and a personal VPN doing SSL inspection triggers this exact error. On a work or school computer, do not change these settings yourself — talk to the IT administrator, since the inspection certificate is usually managed by them.
- Sign in through the Wi-Fi portal or switch networks Public Wi-Fi in cafes, airports, hotels, and offices intercepts HTTPS connections until you sign in, answering every request with the portal's own certificate — which Chrome rightly distrusts. Open a plain http:// page (not https) to trigger the sign-in page, complete it, then reload the site. If you are on a network you do not control, test on your phone's mobile hotspot: if the site loads fine there, the original network was intercepting your connection. This is also why the error often appears on every website at once on public Wi-Fi — the portal intercepts all HTTPS traffic until you sign in.
- Clear the SSL state, update your system, then decide who owns the problem On Windows, clear the cached SSL state: open the Start menu, type Internet Options, open it, go to the Content tab, and click Clear SSL state. Then install pending updates — Windows Update, macOS updates, and browser updates all refresh the trusted root certificates that Chrome relies on. Now check the pattern: if only one website shows the warning on every device and network you try, the site's certificate is the problem — a self-signed certificate, a missing intermediate certificate, or a certificate from a private or distrusted authority. There is nothing you can safely fix on your side; contact the site owner and tell them their certificate chain is incomplete. If every website shows the warning on your computer but other devices are fine, repeat steps 2 through 5 — the cause is in your device or network.
Did this fix it? Quick checklist
- The site loads with a padlock icon and no warning page
- Your system clock is set to automatic and shows the correct date
- The error is gone in an incognito window
- Antivirus HTTPS scanning and the VPN are back on or reconfigured after testing
If the site loads in incognito but not in a normal window, an extension is still intercepting the connection — leave extensions off and re-enable them one at a time. If the warning appears on every website, your device or network is the cause: recheck the clock, the antivirus scanning setting, and the VPN. And if only one website fails on every device you own, the certificate itself is broken — do not click through to log in, contact the site's owner, and use their official app or support channel until the warning clears.
Frequently asked questions
What does ERR_CERT_AUTHORITY_INVALID mean?
It means Chrome tried to verify the website's SSL/TLS certificate and could not trace it back to a certificate authority it trusts. Every browser ships with a list of trusted roots; when the server presents a certificate, Chrome builds a chain from it to one of those roots. If the chain ends somewhere unknown — a self-signed certificate, a private authority, a missing intermediate — Chrome shows Your connection is not private and stops. The site might be fine, but Chrome cannot prove its identity.
Is it safe to click Proceed to the site (unsafe)?
On a public website, no. When Chrome cannot verify the certificate authority, there is no way to know whether the certificate is just misconfigured or whether someone is intercepting your connection. Do not enter passwords, payment details, or any personal information after bypassing the warning. The only exception is a page you set up yourself on your own network — your router admin page, a NAS, or a local development server — where you know exactly what is on the other end.
Why do I get ERR_CERT_AUTHORITY_INVALID on every website?
When the error appears everywhere, the cause is on your device or network, not the sites. Work through this checklist: set the clock to automatic, pause antivirus HTTPS scanning, disconnect the VPN or proxy, and test on a different network like your phone's hotspot. If you are on a work or school computer, your organization's security software is probably re-signing traffic — ask the IT administrator before changing anything.
How is this different from ERR_CERT_DATE_INVALID and ERR_CERT_COMMON_NAME_INVALID?
All three are certificate errors, but the fault is different. ERR_CERT_DATE_INVALID means the certificate expired (or your clock is wrong). ERR_CERT_COMMON_NAME_INVALID means the certificate is trusted but was issued for a different website name — often a missing www or subdomain. ERR_CERT_AUTHORITY_INVALID means Chrome does not trust who issued the certificate at all, usually a self-signed certificate, a missing intermediate, or an interception by software or the network.
Can an antivirus cause ERR_CERT_AUTHORITY_INVALID?
Yes, and it is one of the most common causes. Antivirus programs with HTTPS scanning or web shield features decrypt your traffic to scan it, then re-encrypt it with a certificate they generate. Chrome does not trust that certificate unless the software installed its own authority into your system. Pause the scanning feature as a test — if the warning disappears, reinstall or repair the antivirus so its scanning certificate is trusted, or turn the feature off and rely on the browser's own protection.