Why does my website say 'your connection is not private'?

For all visitors at once, it's a server-side TLS problem: most often an expired certificate, but also a hostname the certificate doesn't cover, an incomplete certificate chain, or only outdated TLS versions being offered. The exact NET::ERR_CERT code identifies which.

Is 'your connection is not private' my problem or the visitor's?

If it happens to everyone, it's your server's certificate configuration. If it happens to one person, it's usually their device — a wrong clock, antivirus intercepting HTTPS, or a public Wi-Fi portal.

How do I stop it from recurring?

Monitor the certificate externally so you're warned weeks before expiry and alerted the moment the chain or hostname breaks after a renewal — rather than finding out when a customer sees the warning.

How to Fix “Your Connection Is Not Private” on Your Website

Updated August 2026 · about a 6-minute read

When visitors hit your site and get a full-screen "Your connection is not private" warning (Chrome's NET::ERR_CERT_* or Firefox's SEC_ERROR_*), they don't see your site at all — most just leave. If it's happening to everyone, the problem is on your server, not their browser. Here are the real causes and the fix for each.

First, identify which error it is

The exact code tells you the cause. Click Advanced on the warning, or run a check to see the underlying reason:

Error	Cause
NET::ERR_CERT_DATE_INVALID	Certificate expired (or the server clock is wrong)
NET::ERR_CERT_COMMON_NAME_INVALID	Certificate doesn't cover this hostname
NET::ERR_CERT_AUTHORITY_INVALID	Untrusted issuer or an incomplete chain
ERR_SSL_VERSION_OR_CIPHER_MISMATCH	Only old TLS/ciphers offered

Cause 1: the certificate expired

By far the most common. Confirm it:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

Fix: renew the certificate (re-run your ACME/Let's Encrypt client, or reissue with your CA) and reload the web server. Then make sure it never happens again — the whole point of expiry monitoring is to warn you weeks before, not after the site is down.

Cause 2: wrong hostname

The certificate is valid but doesn't list the exact name people used — e.g. it covers example.com but not www.example.com, or vice versa. Fix: reissue a certificate whose Subject Alternative Names include every hostname you serve (and redirect one to the other).

Cause 3: incomplete chain

Your certificate is fine but the server isn't sending the intermediate certificate, so browsers can't build a path to a trusted root. It often works in one browser and fails in another, which is the giveaway. Fix: install the full chain (fullchain.pem with Let's Encrypt) rather than just the leaf certificate, and reload.

Cause 4: old TLS only

Modern browsers refuse TLS 1.0/1.1. Fix: enable TLS 1.2 and 1.3 in your server config and disable the old versions.

Stop it happening again

Every cause above is silent until a visitor hits it. A daily external check catches an expiring cert, a chain that breaks after a renewal, or a hostname mismatch before your customers do — and emails you instead. Check your domain below to see exactly what browsers see.

Check your site now — free, no signup

See your TLS certificate, security headers and DNS graded in seconds. Then let Perimeter watch it and email you the moment something breaks.

Open the full checker →