P2MediumRunbook

Certificate Not Trusted Runbook

Browser showing 'Not Secure' or certificate errors? This runbook helps you diagnose the specific problem and fix it quickly.

15-30 minutes
Last Updated: December 2025
Progress: 0/29 complete0%

When to Use

  • • Browser shows "Your connection is not private"
  • • Users reporting certificate warnings
  • • ERR_CERT errors in browser
  • • API clients failing with SSL verification errors

Do NOT Use For

  • • Certificate is expired (use Emergency Replacement Runbook)
  • • Known key compromise (use Key Compromise Response Runbook)

Quick Reference (TL;DR)

  1. Identify the specific error (chain, expired, name mismatch, revoked)
  2. Run diagnostic commands to confirm
  3. Fix based on error type
  4. Verify from external sources

1Identify the Error

Objective: Determine exactly what type of trust error you're dealing with

💡 ERR_CERT_AUTHORITY_INVALID → Chain/trust problem

💡 ERR_CERT_DATE_INVALID → Expired or not yet valid

💡 ERR_CERT_COMMON_NAME_INVALID → Wrong domain name

💡 NET::ERR_CERT_REVOKED → Certificate was revoked

💡 SSL_ERROR_RX_RECORD_TOO_LONG → Not HTTPS or wrong port

2Quick Diagnosis

Objective: Run commands to understand what the server is sending

View certificate being served:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | \
  openssl x509 -noout -subject -issuer -dates -ext subjectAltName

Check chain completeness:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | \
  grep -E "(depth|verify|Certificate chain)"

Full chain dump:

echo | openssl s_client -connect example.com:443 -servername example.com -showcerts 2>/dev/null

Check from curl:

curl -vI https://example.com 2>&1 | grep -E "(SSL|certificate|subject|issuer|expire)"

3Fix: Chain Incomplete

Objective: Add missing intermediate certificates to complete the chain

Find the issuer of your certificate:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | \
  openssl x509 -noout -issuer

Create proper bundle (order matters):

# Order: Your cert first, then intermediates (root optional)
cat your-cert.crt intermediate.crt > bundle.crt

# For nginx:
ssl_certificate /path/to/bundle.crt;
ssl_certificate_key /path/to/private.key;

Reload after update:

# nginx
sudo nginx -t && sudo systemctl reload nginx

# Apache
sudo apachectl configtest && sudo systemctl reload apache2

💡 Download intermediates from your CA's repository page

💡 Common intermediate download pages: DigiCert, Sectigo, Let's Encrypt

💡 Use our Chain Builder demo to help construct the correct chain

4Fix: Certificate Expired

Objective: Replace the expired certificate

Check expiration:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | \
  openssl x509 -noout -dates

5Fix: Wrong Domain Name

Objective: Ensure certificate covers the correct domains

View CN and SANs:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | \
  openssl x509 -noout -subject -ext subjectAltName

💡 Wildcard *.example.com does NOT cover example.com (apex)

💡 Wildcard only covers one level: *.example.com covers www.example.com but not a.b.example.com

💡 Check if accessing via IP - certificates don't cover IPs unless explicitly in SAN

6Fix: Certificate Revoked

Objective: Replace the revoked certificate

Check revocation status via OCSP:

# Get OCSP responder URL from certificate
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | \
  openssl x509 -noout -ocsp_uri

# Query OCSP (requires issuer cert)
openssl ocsp -issuer issuer.crt -cert server.crt \
  -url http://ocsp.digicert.com -resp_text

💡 Revoked certificates CANNOT be un-revoked - must get new certificate

💡 If compromised: generate NEW key, don't reuse old key

7Fix: Self-Signed Certificate

Objective: Replace with trusted CA-issued certificate

Check if self-signed:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | \
  openssl x509 -noout -subject -issuer

# If Subject and Issuer are identical = self-signed

💡 For internal use only: distribute root cert to clients instead of replacing

💡 For public facing: must use trusted CA (Let's Encrypt is free)

8Verify the Fix

Objective: Confirm the trust issue is resolved

Verify trust from command line:

# Should show: Verify return code: 0 (ok)
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | \
  grep "Verify return code"

Test with curl (will fail if untrusted):

curl -I https://example.com

Troubleshooting

Problem: Fixed chain but some clients still fail

Solution: Some clients cache the old chain. Wait for cache to expire or test from new client/device.

Problem: Browser trusts it but curl doesn't

Solution: Curl uses system trust store which may differ from browser. Update CA certificates: sudo update-ca-certificates

Problem: Only fails on older devices/browsers

Solution: May need to include cross-signed intermediate for legacy compatibility. Check CA documentation.

Problem: Works from browser but fails from code/API

Solution: Application may be using own trust store. Check language/framework documentation for adding CA certs.

Related Resources

🎬 Chain Builder Demo🎬 Certificate Error Decoder🎬 Failure Scenarios Demo✅ Emergency Certificate Replacement🎬 CA Hierarchy Guide
← Back to Checklists Library