{"id":2159,"date":"2018-02-02T12:10:41","date_gmt":"2018-02-02T17:40:41","guid":{"rendered":"http:\/\/www.rapidsslonline.com\/blog\/?p=2159"},"modified":"2019-05-09T03:00:50","modified_gmt":"2019-05-09T08:30:50","slug":"solve-certificate-not-trusted-error","status":"publish","type":"post","link":"https:\/\/www.rapidsslonline.com\/blog\/solve-certificate-not-trusted-error\/","title":{"rendered":"Solve it Yourself: Your Certificate Is Not Trusted Error"},"content":{"rendered":"

SSL Certificate Not Trusted Error – Troubleshooting common SSL certificate mistakes<\/h2>\n

You\u2019ve gone through all the trouble of researching what SSL certificate to purchase, you\u2019ve been validated, gotten it issued and even installed it on your server. But now you\u2019re receiving an error message, \u201cYour SSL Certificate is not trusted.<\/strong>\u201d<\/p>\n

<\/p>\n

The browsers all say this in different ways, some are extremely explicit, others are pretty cursory, but the effect is always the same: this certificate can\u2019t be trusted.<\/p>\n

So what do you do? You throw your monitor out of your office window is what. Carl is always in favor of taking your frustration out on computer equipment. I once punted a router into the ceiling panels. That was actually how we discovered the asbestos at my last job. They weren\u2019t as thankful for that discovery as they probably should have been\u2026<\/p>\n

Anyway, let\u2019s talk about why your SSL certificate is receiving these \u201cNot Trusted<\/strong>\u201d error messages and try to help you solve the problem.<\/p>\n

Why does it say SSL Certificate is not Trusted?<\/h3>\n

It all starts with the browsers\u2019 root stores. Most browsers maintain their own root stores, the ones that don\u2019t typically use Google or Mozilla\u2019s. A root store sometimes referred to as a trust store, is a collection of pre-downloaded root certificates from trusted certificate authorities. If a browser reaches a website that features a certificate that was not issued by one of these trusted CAs it will give the user an error message about not being able to trust the certificate.<\/p>\n

There are a few reasons this might happen\u2026<\/p>\n

You might be getting an error because you have a self-signed certificate<\/h3>\n

Self-signed certificates are fine for testing environments and internal networks, they are not a good idea for any public-facing IP. And that goes back to the root stores. As I mentioned, browsers have a set of pre-downloaded root certificates from trusted CAs. The problem a self-signed certificate has is that it doesn\u2019t chain back to a trusted root certificate from a trusted CA.<\/p>\n

If you self-signed your SSL certificate on purpose, go directly to jail. Do not pass go. Do not collect $200. Just kidding. But you will need to go through a trusted CA to get a new SSL certificate and install it on your network.<\/p>\n

Alternatively, you could also add the certificate to your root store. There are directions for how to do this on the various browsers. Just be warned, the certificate will now be trusted on your browser, but anyone that hasn\u2019t added the certificate to their own root store will still receive the error message. Again, I only recommend doing this for internal networks and testing.<\/p>\n

If you bought a certificate from a trusted CA and you\u2019re still getting this message, then you may need to go back through the installation instructions and make sure you didn\u2019t miss any steps. This is actually a fairly easy mistake to make. That\u2019s one of the reasons I have our CED team install all of my SSL certificates. That way if anything goes wrong I have someone to yell at. Fortunately, nothing has gone wrong, but if it does I\u2019m putting a tack on Justin\u2019s chair.<\/p>\n

If all else fails, you may need to regenerate your Certificate Signing Request (CSR)<\/a><\/strong> and re-issue your certificate. This is the nuclear option. Before you do this you might want to call us and see if we can help first. If you talk to Justin tell him Carl is watching him.<\/p>\n

You might be getting an error because of intermediate certificate issues<\/h3>\n

Another possibility is that you\u2019re receiving this error because of an issue with the installation of your intermediate certificates. This is a common mistake too. First let me explain why this is important.<\/p>\n

Remember our root store? Browsers are able to tell if a certificate is trusted by chaining it back to one of the trusted roots in its store. It does this with use of intermediate certificates. When you receive your SSL certificate from your CA<\/strong>, it oftentimes comes with an intermediate certificate bundle. This is just as important to install as the SSL certificate itself because this is what establishes the Chain of Trust.<\/p>\n

If the browser can\u2019t establish the chain of trust and link your SSL certificate to one of the roots it trusts, then it\u2019s going to issue a warning about not being able to trust the certificate.<\/p>\n

Again, if you\u2019re receiving this error, first make sure you\u2019ve installed your intermediate certificate, then go back through the instructions and make sure you did everything correctly.<\/p>\n

And if all else fails, call us.<\/p>\n

Or if you have phone anxiety live chat is pretty cool, too.<\/p>\n

Other Troubleshooting Guides for SSL Certificate Error<\/h3>\n