SSL Not Working: Fix It by Stage
An SSL error means the browser could not open a trusted encrypted connection. Read the code first: a TLS protocol error is not a certificate problem, while ERR_CERT_DATE_INVALID is an expired or not-yet-valid certificate. Fix the stage that failed, then re-check from outside with openssl or an SSL checker.
Diagnosis for site owners: match the browser code to the failing TLS stage, then fix chain, dates, hostname or mixed content.
knowledge
- Read time
- 5 min
- Sections
- 7
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 15 November 2026.
Which SSL error code are you actually seeing?
The code under the browser warning names the failing stage, so read it before changing anything — reinstalling a certificate that was never the problem is how an hour becomes an afternoon.
| Code | What failed | First fix |
|---|---|---|
| ERR_SSL_PROTOCOL_ERROR | Handshake, before any certificate | Check the port, proxy and server TLS settings |
| ERR_CERT_AUTHORITY_INVALID | Chain of trust | Install the intermediate certificates |
| ERR_CERT_COMMON_NAME_INVALID | Hostname not in the certificate | Reissue for that name or add it to the SAN list |
| ERR_CERT_DATE_INVALID | Expired, not yet valid, or device clock | Renew, or fix the clock on the device |
| ERR_SSL_VERSION_OR_CIPHER_MISMATCH | No shared protocol or cipher | Enable TLS 1.2 and 1.3 on the server |
| No padlock, page still loads | Mixed content | Move http:// resources to https:// |
Why does an HTTPS connection fail in one of four stages?
Every HTTPS request passes through connect, negotiate, validate and carry-data stages, and the error tells you which one stopped — which is why generic advice helps some people and does nothing for the rest.
- Connect. The browser opens TCP to port 443. If the other end answers plain HTTP or closes early, no certificate is involved at all.
- Negotiate. Both sides agree a TLS version and cipher suite. A mismatch is a configuration problem, not a certificate problem.
- Validate. The server presents its chain; expiry, hostname coverage, trust and revocation are checked here. Codes starting with ERR_CERT point to this stage.
- Carry data. The encrypted session works; failures now come from mixed content, HTTP/2 or QUIC, not the certificate.
If the browser says the connection is not private with an ERR_CERT code, you are at stage three. If it says protocol or cipher, you are at stage two, and a new certificate changes nothing. The vocabulary behind this is unpacked in SSL vs TLS, explained simply.
How do you check the certificate the server actually serves?
Query the live endpoint with openssl instead of trusting the file on disk — these commands show the chain, the dates and whether the hostname matches.
# full chain as sent by the server
openssl s_client -connect example.com:443 \
-servername example.com -showcerts </dev/null
# dates and subject only
openssl s_client -connect example.com:443 \
-servername example.com </dev/null \
| openssl x509 -noout -dates -subject
# hostname verification
openssl s_client -connect example.com:443 \
-servername example.com \
-verify_hostname example.com </dev/nullRead the certificate list, not only the Verify return code line. "No peer certificate available" means the handshake failed before validation, so the certificate is not the fault. Then run the same host through the WebJi® SSL checker or SSL Labs for a second opinion from outside your own network — a proxy or CDN can serve a different certificate than the origin.
How do you fix an incomplete certificate chain?
Most ERR_CERT_AUTHORITY_INVALID errors are a missing intermediate: the browser trusts the root, your server sends only its own certificate, and the link between them is absent.
- Download the full chain from the CA — your certificate plus the intermediate, in that order.
- In cPanel open Security → SSL/TLS Status and confirm the domain shows a valid certificate with a complete chain.
- For a manual install, point the server at the combined file. Never put the private key in that file.
- Reload the web server, then re-run the openssl command until the chain lists more than one certificate.
- Test on a phone too — mobile platforms are stricter about incomplete chains than desktops.
The full click-path for a fresh certificate is in the install SSL in cPanel guide. If the chain is complete and the error remains, move on to dates and hostname.
What about expired certificates, wrong hostnames and bad clocks?
Three certificate faults produce three different codes, so match the fix to the one you see: expiry, hostname coverage, or a clock that is wrong on either end.
- Expired: renew and install. If the renewal was recent, a proxy or CDN may still serve the old certificate — query the live one with openssl.
- Not yet valid: the server clock or the certificate start date is wrong. Fix NTP on the server before reissuing.
- Hostname mismatch: browsers check the subjectAltName list, not the common name. A certificate for example.com does not cover shop.example.com unless it is a wildcard or lists it.
- Wrong visitor clock: a phone or laptop months out of date reports ERR_CERT_DATE_INVALID on every site it opens. That one is fixed on the device, not your server.
- Revoked: the CA cancelled the certificate. Reissue rather than reinstall.
Browser caching sits behind several "still broken" reports: a browser that cached the old certificate or an HSTS-remembered redirect keeps showing the warning until it refreshes. Test in a private window before believing your fix failed.
Why does the padlock disappear when the page loads fine?
Mixed content: the page loads over HTTPS but still asks for an image, script, font or iframe over HTTP, so the browser downgrades the padlock even though the certificate is fine.
- Open the page, then DevTools → Console, and reload. Mixed-content warnings name the exact URL.
- Search the theme or template for
http://and move those resources tohttps://or relative paths. - In WordPress, run a search-replace on the database for the old http URL, then check the customiser and widgets.
- Add a Content-Security-Policy header with
upgrade-insecure-requestsas a safety net — not as the only fix. - In OpenCart or Magento, set the store URL itself to https; a store setting left on http recreates the problem on every page.
The same fault seen from the visitor's chair is covered in the browser "Not secure" warning guide, and the CDN angle in Cloudflare vs Bunny CDN.
How do you stop the next SSL failure from happening?
Three habits remove nearly all repeat failures: automated renewal, outside expiry monitoring, and a re-check after every migration, CDN change or panel update.
- Automate renewal: on WebJi® hosting, free Let's Encrypt SSL renews automatically every 90 days — leave it on.
- Monitor expiry externally: a broken renewal should be an alert weeks early, not a warning page on a Monday morning.
- Re-check after changes: migrations and CDN switches are the classic chain-breakers; test on a phone as well as a desktop.
For a commercial certificate with a warranty, the SSL certificate page lists the options — Sectigo PositiveSSL is listed at ₹1,800 a year before 18% GST, and checkout confirms current charges. If the chain looks correct and the error persists, email support@webji.services with the domain, the error code and your openssl output; support answers 24/7 in Hindi and English, average first reply under 60 minutes.
Frequently asked questions
Why is my SSL certificate not working?
Read the browser code first. ERR_CERT_AUTHORITY_INVALID is usually a missing intermediate, ERR_CERT_DATE_INVALID is expiry or a wrong device clock, ERR_CERT_COMMON_NAME_INVALID means the hostname is not in the certificate, and ERR_SSL_PROTOCOL_ERROR happens before any certificate is checked.
Why does SSL show expired right after renewal?
Either the new certificate was not installed where the site is served from, or a proxy or CDN still serves the old one. Query the live certificate with openssl s_client and compare its dates with the file you installed; the origin and the edge can differ.
What causes HTTPS redirect loops?
Two rules pointing at each other: the application forces HTTPS while a proxy or CDN forwards plain HTTP back to it, so each side keeps redirecting. Tell the application it sits behind a proxy, or terminate TLS in one place only.
How long does SSL take to activate after installation?
A DNS-validated certificate is usable as soon as it is installed and the web server reloads; browsers see it on the next request. DNS propagation only matters when the domain itself is being moved. Expect minutes, not days.
Why is my padlock missing on only some pages?
Mixed content on those pages — an image, script or font still loaded over HTTP downgrades the padlock even though the certificate is valid. Open DevTools Console, reload, and the warning names the exact URL to move to https.
Last editorial update: 15 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.