The short answer
A padlock warning means your browser cannot confirm the site's identity or the connection is not fully encrypted. Do not click through or enter any details. The usual causes are an expired certificate, a certificate for a different address, or insecure files on a secure page. Send us a screenshot of the warning and the page address.
What the padlock actually tells you
An SSL certificate does two jobs. It encrypts the connection between a visitor and your site so nobody in between can read it. And it proves that the site answering at your address is really the one the certificate was issued for. The padlock and the https at the start of the address are the visible result.
When something about that proof fails, the browser stops the visitor with a warning instead of loading the page. That is the browser doing its job. The warning does not mean the site has been hacked, though it does mean nobody should type anything sensitive into it until it is fixed.
What the common warnings mean
Browsers word these differently, but the underlying causes are few. The exact code shown is a good clue, so always include it when you report.
| What you see | Plain meaning | Usual cause |
|---|---|---|
| NET::ERR_CERT_DATE_INVALID (Chrome), expired certificate (Firefox) | The certificate is past its end date, or your device clock is wrong | Renewal failed or was not set up |
| NET::ERR_CERT_COMMON_NAME_INVALID, bad cert domain (Firefox) | The certificate was issued for a different address than the one you used | Covers example.com but not www.example.com, or the wrong site is attached |
| NET::ERR_CERT_AUTHORITY_INVALID | The browser does not trust who issued the certificate | A self-signed or incomplete certificate chain |
| Not secure, no padlock on a page that loads | The page loaded, but part of it is not encrypted | Mixed content: some files load over http |
Before blaming the site, check your own device clock. A computer or phone with the wrong date and time can make every secure site look expired. If many sites warn at once, that is the likely cause.
Expiry: why it happens to well-run sites
Certificates are issued for a limited time and have to be renewed. Many are renewed automatically. Let's Encrypt, a widely used free issuer, issues certificates valid for 90 days by default and recommends renewing them every 60 days, which only works if the automatic renewal keeps working. Other certificates are bought for a year and renewed by hand.
Renewal fails for ordinary reasons: a payment lapsed, a DNS change broke the check the issuer performs, the hosting moved and the renewal job did not come along, or a server setting changed. The site works fine until the day it does not. If the warning appeared at the same time as a hosting or DNS change, tell us, because that timing is the most useful clue.
Mixed content: the padlock that goes missing
Sometimes the page loads and the certificate is valid, yet the padlock is gone or crossed out. That usually means mixed content: a page delivered securely that pulls in some of its files, such as an image, a script or a font, over plain http. MDN's guidance describes how browsers react. Images and other low-risk files are upgraded to https if possible. Scripts, stylesheets and similar files are blocked, which is how a page ends up looking broken as well as insecure.
The fix is to make every address in the page use https. This often happens after an old site is moved to https, when thousands of old links in pages, widgets and theme settings still say http. It is a content and configuration job for us rather than something to repair page by page in the editor.
Wrong domain: www versus non-www
A certificate lists the exact names it covers. A site can be reachable at example.com and at www.example.com, and those are two different names. If the certificate covers only one, visitors who type the other get a name mismatch warning. Links in old emails and printed material are the usual way people end up on the wrong version.
The healthy setup is one preferred version, a certificate that covers both, and a permanent redirect from the one you do not use. If you see the warning only on one version, tell us which, because it means the other is set up properly.
Why you must not click through
This applies to your own site too. It is tempting to bypass the warning for a site you know, but then you cannot tell a simple expiry from an attacker sitting between you and the server, and your visitors cannot either. Report it and let us confirm the cause.
Do not use Advanced, then Proceed on a certificate warning, and never enter a password, a card number or personal details on a page with a warning. The browser cannot confirm who is answering. Clicking through is the exact situation the warning exists to prevent, and a page that looks right may not be.
A worked example
Example: Works on the phone, warns on the laptop
A law firm's receptionist sees 'Your connection is not private' with NET::ERR_CERT_DATE_INVALID on her laptop. Her phone loads the same site fine. She checks the laptop date: it says 2019, after a battery failure reset the clock. Setting the time automatically clears the warning in seconds. A month later a client emails a screenshot of the same code, from a correct device. This time the certificate really did expire, because the host moved servers and the renewal job was not recreated. That is a ticket. Same code, different causes, and the first check was always the clock.
When to ask us
Ask immediately for any certificate warning on a page of your own site, and for a missing padlock on a page that takes payments, logins or enquiries. A warning in front of visitors costs enquiries by the hour.
Send the page address, a full screenshot of the warning showing the error code and the address bar, the browser and device, whether it happens on a second device and network, which version of the address you used (with or without www), and whether anything changed recently with hosting or DNS. Put it in one request through the support form. If the whole site cannot be reached, start with my website is down. Your proposal covers who holds the certificate and renewal.
