Diagnose an invalid SSL certificate

Reviewed on October 8, 2026 3 min read ssl autossl

A certificate warning means the browser could not verify the connection as expected. Note down the exact error code and the name in the address bar. Do not enter passwords or payment details by skipping the warning.

Identify the type of error

What you see	What to check
Name not covered	The certificate must include the exact domain, including `www` if you use it
Certificate expired or not yet valid	Certificate dates and the device's clock
Issuer not recognised	Intermediate chain, self-signed certificate or traffic inspection on the network
Certificate from another server	Public DNS, IPv6, proxy and the site that responds

Test the same name from another device or connection and compare the certificate details. This lets you tell a general problem from one affecting that device or network. A mixed content warning means checking HTTP resources, even if the main certificate is valid.

To see it from outside, our SSL checker shows the certificate served for that name, the names it covers, the issuer, its dates and the chain, and checks whether a browser would trust it. It warns you if it has expired, is self-signed or does not match the name. Test only one of the published addresses.

If you rely on AutoSSL

In cPanel > SSL/TLS Status, look up the affected name and its validation error. In recent versions it may be a tab in SSL/TLS Certificates. AutoSSL covers eligible names that pass validation; starting a run does not guarantee issuance.

Check the public A and AAAA records, that validation reaches the intended server and that CAA does not prevent issuance. Do not delete records or disable a CDN blindly: behind a proxy you need to check both its public certificate and the origin's.

If you have just changed DNS, wait until the correct values are public. If Run AutoSSL is available, you can request a run and check the result when it finishes. If the option does not appear or the error persists, tell us the domain, the message and the time of the check. There is no universal propagation or issuance time.

If you installed an external certificate

Check the name, expiry, matching key and the authority's chain. Follow the installation guide and confirm who is responsible for renewing it. Renewing the commercial product and serving a new certificate are separate checks.