You have installed an SSL certificate, but instead of the green padlock you see an error message. Or worse: your visitors get a warning that your website is not secure. SSL certificate problems occur more often than you think, but they can almost always be solved. In this article we cover the 7 most common errors.

1. Mixed content warning

This is the most common SSL problem. Your website loads over HTTPS, but some files such as images, scripts or stylesheets are still loaded over HTTP. The browser blocks these files or shows a warning that the page is not fully secure.

How do you recognize it?

You do not see a green padlock but a triangle with an exclamation mark. In the browser console (press F12) warnings about Mixed Content appear. The page does work, but is not considered fully secure.

How to fix it

  • Search your database and files for http:// URLs that point to your own domain and replace them with https://
  • Use relative URLs where possible, for example /images/photo.jpg instead of a full address
  • Check your theme and plugins for hardcoded HTTP URLs that do not automatically switch to HTTPS
  • Add the header Content-Security-Policy: upgrade-insecure-requests to your server configuration

2. Expired SSL certificate

SSL certificates have a limited validity period. Let's Encrypt certificates expire after 90 days, commercial certificates usually after 1 year. When your certificate expires, visitors see a red warning page and can no longer reach your website.

How do you recognize it?

Visitors get the message NET::ERR_CERT_DATE_INVALID or a similar error. You can check the expiry date by clicking the padlock in the address bar and viewing the certificate.

How to fix it

  • Let's Encrypt: check whether automatic renewal is set up correctly via a cron job. Most hosting panels handle this automatically, but sometimes renewal fails silently.
  • Commercial certificate: renew it with your provider and install the new certificate on your server.
  • Prevention: set a reminder two weeks before the expiry date. Use certificate monitoring that warns you automatically.

3. Wrong or missing HTTP to HTTPS redirect

After installing an SSL certificate, all HTTP traffic must be automatically redirected to HTTPS. Without this redirect your website is reachable over both protocols. This is bad for SEO because Google indexes two versions of your site, and it is a security risk.

How do you recognize it?

Type the address of your website with http:// in front of it. If you are not automatically redirected to https://, the redirect is missing.

How to fix it

Add a 301 redirect. For Apache you do this in the .htaccess file with RewriteEngine rules. For Nginx you add a server block that listens on port 80 and does a return 301 to the https variant. Do not forget to also adjust your CMS settings so that the site URL is set to https.

4. SSL certificate does not match the domain

An SSL certificate is linked to a specific domain. If the certificate was issued for www.example.com but you visit example.com without www, the browser can give an error about a non-matching certificate.

How do you recognize it?

The error NET::ERR_CERT_COMMON_NAME_INVALID appears. This means the domain name in the certificate does not match the URL the visitor typed.

How to fix it

  • Use a certificate that covers both variants. With Let's Encrypt you specify both domains as a parameter when requesting.
  • Or use a wildcard certificate that covers all subdomains under your main domain.
  • Set up a redirect from the variant without a certificate to the variant with a certificate.

5. Incomplete certificate chain

An SSL certificate works with a chain of trust. Your certificate is signed by an intermediate authority, which in turn is signed by a root authority. If the intermediate certificates are missing on your server, the browser cannot verify the chain.

How do you recognize it?

The message NET::ERR_CERT_AUTHORITY_INVALID appears, or SSL checkers report Incomplete certificate chain. Remarkably, it often works in Chrome on desktop but not on mobile devices or other browsers.

How to fix it

  • Download the intermediate certificates from your certificate issuer
  • Combine them with your server certificate in the correct file: first your own certificate, then the intermediates
  • Test the full chain with an online tool such as SSL Labs Server Test before you go live

6. Outdated TLS version

Older TLS versions such as 1.0 and 1.1 contain known vulnerabilities and are no longer supported by modern browsers. If your server only offers these old versions, visitors can no longer reach your website.

How do you recognize it?

Visitors see ERR_SSL_VERSION_OR_CIPHER_MISMATCH. This mainly occurs with older servers that were never updated.

How to fix it

Configure your web server to only support TLS 1.2 and 1.3. This is a one-time change in your Nginx or Apache configuration. TLS 1.2 is supported by all modern browsers and devices, so you do not exclude any visitors.

7. Redirect loop (too many redirects)

This happens when HTTP redirects to HTTPS, but HTTPS redirects back to HTTP again. Or when multiple redirect rules contradict each other. The browser stops after too many redirects and shows an error message.

How do you recognize it?

The error ERR_TOO_MANY_REDIRECTS appears. Your website does not load at all anymore, no matter which URL you try.

How to fix it

  • Check whether your CMS uses the correct site URL with https and not http
  • Check whether your htaccess or server configuration does not contain duplicate or conflicting redirect rules
  • If you are behind a CDN or load balancer such as Cloudflare, set the SSL mode to Full or Full Strict instead of Flexible
  • Clear your browser cache and cookies after adjusting the configuration to reset the old redirects

Preventing SSL problems

Most SSL problems can be prevented with a few simple measures:

  • Use automatic renewal: most hosting providers support automatic Let's Encrypt renewal. At Theory7 this is set up by default with your hosting package.
  • Test after every change: check your SSL configuration after server changes, domain migrations or CMS updates with an SSL checker.
  • Monitor your certificate: use a monitoring tool that automatically warns you when your certificate is about to expire.
  • Choose reliable hosting: with good web hosting SSL is configured correctly by default.

At Theory7 you get a free SSL certificate with every hosting package, including automatic renewal and correct configuration. That way you do not have to worry about SSL problems.

Checking your SSL certificate: handy tools

Before you start solving SSL certificate problems, it is useful to know exactly what is wrong. These free tools help you with that:

SSL Labs Server Test

The most comprehensive free SSL test. Enter your domain name and you get a complete analysis of your certificate, chain, TLS configuration and known vulnerabilities. You receive a letter grade from A to F. Aim for at least an A grade for production websites.

Why No Padlock

Specifically designed to track down mixed content problems. This tool scans your page and shows exactly which files are still loaded over HTTP. Ideal if you are missing the padlock in the browser but do not know which file is causing it.

Certificate Decoder

Upload or paste your certificate and this tool shows all the details: domain names, expiry date, issuer, key length and chain information. Handy to check whether you have installed the correct certificate and whether the chain is complete.

Renewing your SSL certificate: how to prevent downtime

Renewing an SSL certificate does not have to cause downtime. With Let's Encrypt the renewal runs automatically via certbot or your hosting panel. The new certificate is installed while the old one is still valid, so there is no interruption. With commercial certificates you request the new certificate before the old one expires, install it and restart the web server. The switchover takes less than a second.

Plan the renewal at least two weeks before the expiry date. That way you have time to solve any problems without your visitors being affected by an expired certificate. Set an automatic reminder, or use monitoring that warns you when your certificate expires within 30 days.

SSL problems during domain migration

When migrating your website to a new hosting provider you regularly run into SSL problems. The old certificate does not work on the new server because it is linked to the previous server configuration. You have to request a new certificate after your DNS points to the new server. During DNS propagation your site may temporarily be without a valid certificate. Therefore plan the migration outside peak hours and keep the old certificate available as a fallback until the DNS has fully switched over.

Summary: preventing and solving SSL certificate problems

The seven SSL certificate problems we covered in this article are by far the most common. Mixed content, expired certificates and incorrect redirects together account for more than 90 percent of all SSL-related error messages. The good news: they can all be solved without deep technical knowledge.

The most important step you can take is preventive: choose a hosting provider that handles SSL automatically. At Theory7 your Let's Encrypt certificate is installed and renewed automatically. Should you still run into a problem, our support team is happy to help you further. Use the tools we mentioned to diagnose the problem and follow the corresponding solution. In most cases your website is fully secure again within fifteen minutes.

Do you have SSL certificate problems that are not in this article? Contact the Theory7 support team. Our specialists are happy to help you diagnose and solve any SSL-related error message, so that your website is safe and reachable again for all your visitors.

Frequently asked questions about SSL certificate problems

How do I know if my SSL certificate works correctly?

Check your website in the browser: you see a padlock next to the URL and the connection shows HTTPS. For a more thorough test use SSL Labs Server Test. If you have SSL certificate problems, the browser shows a warning or a red cross next to the padlock.

Can SSL certificate problems harm my SEO?

Yes, SSL certificate problems have a direct impact on your position in Google. Since 2014 HTTPS has been a ranking factor. An expired or misconfigured certificate leads to browser warnings that scare off visitors. Google can also mark your pages as unsafe in the search results, which lowers your click-through rate.

How often do SSL certificate problems occur?

SSL problems occur more often than you think. Research shows that around 3 percent of all websites show a certificate error at some point. The most common cause is an expired certificate, followed by mixed content and incorrect redirects. With automatic renewal via Let's Encrypt you prevent the majority of these problems.

Sources and references

  • Let's Encrypt - Free SSL certificates (letsencrypt.org)
  • Cloudflare - Learning Center (cloudflare.com/learning)
  • SSL Labs - SSL Server Test by Qualys (ssllabs.com)