“Your connection is not private”
The browser refused to open your site because its SSL/TLS certificate doesn't check out: it has expired, it's for a different name, it's self-signed, or the chain is incomplete. Chrome shows "Your connection is not private" with a code like NET::ERR_CERT_DATE_INVALID; Safari and Firefox say "This Connection Is Not Private" or "Warning: Potential Security Risk Ahead". Most visitors close the tab, so this is a site that's down for practical purposes.
Is your site showing it right now?
The free scan loads your page like a visitor and checks for this message, plus broken links, script errors and phone layout. It also walks your signup, booking or contact form, without sending anything.
Free, no signup. Usually done in about a minute.Why it happens
- The certificate expired (Let's Encrypt certificates last 90 days and have to renew automatically; a broken renewal is the most common cause)
- The certificate was issued for another name: it covers example.com but not www.example.com, or a subdomain was added and never certified
- DNS was pointed at a new server or CDN that doesn't have a certificate for your domain yet
- The site runs behind Cloudflare with the SSL mode set to Full (strict) while the origin has a self-signed or expired certificate
- The server sends only its own certificate, not the intermediate one, so some devices can't build the chain (NET::ERR_CERT_AUTHORITY_INVALID)
How to fix it
Read the error code
Click the padlock or the warning's details. DATE_INVALID means expired (or the visitor's clock is wrong); COMMON_NAME_INVALID means the wrong name; AUTHORITY_INVALID means self-signed or an incomplete chain. Each has its own fix below.
Expired: renew the certificate
On managed hosting, the panel's SSL section has a renew or reissue button. On a server you run, certbot renew --force-renewal, then reload the web server, and check the renewal timer is enabled so it doesn't happen again. Then clear your CDN's cache if you use one.
Wrong name: cover every hostname
Reissue the certificate with both example.com and www.example.com (and any subdomain visitors use). On Cloudflare, Netlify, Vercel or your host, add the missing domain to the site and let it issue a certificate.
Chain or self-signed: install the full chain
Install the certificate with its intermediate (the fullchain file), not the certificate alone. With Cloudflare, give the origin a Cloudflare Origin Certificate or set SSL to Full while you fix it, never Flexible on a site with a login.
Check it from outside
Run an SSL checker on your domain (or the free scan above) from a device that isn't yours. It reports the expiry date, the names covered and whether the chain is complete, so you know the fix took.
Questions
Can visitors click through anyway?
In most browsers there's an advanced link to proceed, but almost nobody uses it, and Chrome hides it for sites that enable HSTS. Treat the warning as the site being down.
Why does it only show on some devices?
Older phones and devices lack newer root certificates, and a missing intermediate certificate shows up only on devices that haven't cached it. Installing the full chain fixes both.
How do I stop it happening again?
Let your host or CDN manage the certificate if it offers to; those renew on their own. Otherwise make sure the renewal job runs and get an expiry alert well before the date: a monitor that checks the certificate daily will tell you two weeks out.
Can Page Canary tell me if this comes back?
Yes. Page Canary checks your key pages every day for this message and others like it, confirms it on a second check, and emails you with the fix. One site is free.