Troubleshooting2026-08-15•4 min read

"Your Connection Is Not Private": Every Cause and Fix

· CSR.plus Team

•This warning groups several distinct errors: expired cert, hostname mismatch, untrusted CA, self-signed cert and system clock issues.
•Site owners: fix the certificate; visitors: check the date and network first.
•Use openssl s_client to get the exact reason in seconds.

Error families

date, hostname, CA, self-signed, clock

Certificate

Site-owner fix

renew / redeploy chain

Clock + cache

Visitor fix

date, network, clean profile

openssl

Diagnosis

exact reason in seconds

Five causes, one warning

Chrome shows "Your connection is not private" for five distinct problems: NET::ERR_CERT_DATE_INVALID (expired or wrong date), NET::ERR_CERT_COMMON_NAME_INVALID / SAN mismatch (certificate does not cover the hostname), NET::ERR_CERT_AUTHORITY_INVALID (untrusted CA or missing intermediate), NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM (SHA-1), and certificate transparency errors. Each needs a different fix.

Diagnose in seconds with openssl

openssl s_client -connect host:443 -servername host prints "Verify return code". Code 10 (certificate has expired), 18 (self-signed), 19 (untrusted root), 20 (unable to get local issuer) and 62 (hostname mismatch) map directly to the five causes above. Then apply the matching fix from the related guides.

What to do on the visitor side

First check the system date and timezone — an incorrect clock makes every certificate look expired. Try another network (corporate proxies with TLS inspection trigger CA errors). Try a clean browser profile. If the warning persists everywhere for a site you trust, the site owner has a configuration problem — avoid entering credentials until it is fixed.