Why does my browser say the security certificate is not valid?
What the warning actually checks, why the commonest cause is your own clock, and how to tell a harmless local problem from the one case where the warning is doing its job.
- Difficulty
- beginner
- Time
- 20 min
- Read
- 6 min
- Safety
- warning
Short answer
Check your device's date and time first — a clock that is wrong makes every certificate look expired or not yet valid, and correcting it fixes every site at once. If the clock is right and only one site warns, be cautious: read the reason the browser gives, and never enter a password or card details past the warning. If every site warns on one particular network, something on that network is intercepting your traffic.
Every secure site presents a certificate that does two jobs: it proves the site is who it claims to be, and it is signed by an authority your device trusts. Your browser checks the signature, checks the name matches, and checks today's date falls inside the certificate's validity window. A failure in any of those produces the warning, and the causes are wildly different in seriousness — a clock an hour out and an attacker intercepting your connection produce the same red screen. The pattern tells you which: all sites failing points at you, one site failing points at that site, and all sites failing on one network only points at the network.
Safety
Step by step
- Check the date and time on the device.This is the single most common cause and it explains the most alarming version of the symptom, where every site fails at once. A device that thinks it is in the past reports certificates as not yet valid; one in the future reports them as expired. Set the time to automatic and reload — the catalogue has a full guide on a wrong clock.
- Read the specific reason.Browsers name it: expired, name mismatch, self-signed, issued by an unknown authority, or revoked. An expired certificate on a small site is usually neglect. A name mismatch means the certificate is for a different address, which can be a misconfiguration or an impersonation. An unknown authority on a public site is the most concerning.
- Note whether it is one site or all of them.One site: that site's problem, or you are on the wrong address. All sites: your device or your network. All sites but only on one wifi network: that network is intercepting traffic, which some workplaces and some hotels do, and which malware also does.
- Check the address bar carefully.A name mismatch warning is precisely what a lookalike domain produces. Read the address character by character — the catalogue's guide on reading a web address covers the substitutions that are designed not to be noticed. If you arrived by clicking a link in a message, go to the site by typing the address instead.
- Try the same site on mobile data.If it works on mobile data and fails on your wifi, the network or the router is involved. That is a decisive test and it takes thirty seconds.
- Suspect security software that inspects traffic.Some antivirus and parental control products intercept encrypted connections deliberately, substituting their own certificate. When their component breaks or expires, every site warns. Turning off the HTTPS scanning feature is the test.
- Check the device is still getting updates.Certificate authorities' root certificates expire and are replaced, and a device that stopped receiving updates years ago progressively loses the ability to verify new certificates. On an old phone, tablet or smart television this is a common and unfixable cause, and it is a real end-of-support symptom.
- Do not proceed on anything that matters.If it is a small personal site with an expired certificate and you are only reading, proceeding is a judgement you can make. On anything involving a password, a payment or personal details, the correct action is to stop. The warning is cheap; the alternative is not.
Common mistakes
- Clicking Advanced and Proceed as a habit — It trains you to dismiss the one warning that stands between you and a convincing fake. People who have done it once on a harmless site do it without reading on the site that matters.
- Installing a certificate because a page told you to — Installing a certificate authority tells your device to trust whoever holds it, for every site, silently. It is a legitimate step only on a managed work device from your own IT department, and a serious compromise in every other context.
- Blaming the site when every site is failing — All sites failing at once is almost never a hundred simultaneous mistakes. It is your clock, your network, or your security software, and checking the clock takes ten seconds.
If it doesn't work
Every site warns, on every network
Cause: The device clock — Fix: Set date and time to automatic. This resolves it instantly and completely, and it is the first thing to check every time.
One site only, warning says expired
Cause: The site let its certificate lapse — Fix: Common on small sites and it is their problem to fix. Do not sign in until it is corrected. If it is a business you deal with, contacting them is genuinely useful — many do not know.
Every site warns on one wifi network only
Cause: That network is intercepting traffic — Fix: Some workplaces do this deliberately with a certificate installed on managed devices. On a public network it is a reason to disconnect and use mobile data instead.
Warning names a security product as the issuer
Cause: Antivirus HTTPS inspection — Fix: Turn off the HTTPS or SSL scanning feature in the security product, or update it. Its certificate has expired or its integration has broken.
Only on an old device
Cause: Expired root certificates on an unsupported system — Fix: If the device no longer receives updates, this progressively gets worse and cannot be fixed. The catalogue's guides on end of support cover the options.
Name mismatch on a site you reached from an email
Cause: Possibly a lookalike domain — Fix: Close it. Go to the organisation by typing the address you know, or through their app. Treat the email as suspicious — the catalogue's phishing guide covers what to do next.
Questions people ask
What does the padlock actually prove?
That the connection is encrypted and that the site presented a valid certificate for the address in the bar. It does not prove the site is honest — a scam site can and does obtain a valid certificate for its own domain. The padlock is about the connection, not the character of the operator.
Is it ever safe to click through?
On a site where you are only reading and will type nothing, and where you understand why it failed — an expired certificate on a hobby site, or a device on your own network with a self-signed certificate — the risk is low. On anything involving credentials, payment or personal data, no.
Why did this start on my old tablet?
Certificate authorities replace their root certificates periodically, and a device that no longer receives updates does not learn the new ones. Over time more and more sites become unreachable. It is one of the clearest practical consequences of a device losing support.
My work laptop warns at home but not in the office
Many organisations inspect traffic through their own certificate, installed on the laptop and trusted only for their network's inspection point. Off the corporate network the arrangement can behave oddly. Ask your IT team rather than working around it.