NET::ERR_CERT_AUTHORITY_INVALID: When the Root Itself Is Not Trusted
The hostname matches. The chain is complete — every intermediate is present, each certificate signs the next, and it all leads up to a single certificate at the top. The dates are fine. And the browser still slams the door: Your connection is not private NET::ERR_CERT_AUTHORITY_INVALID Every stack says it in its own accent. Chrome and Edge say NET::ERR_CERT_AUTHORITY_INVALID . Firefox says…
The error NET::ERR_CERT_AUTHORITY_INVALID occurs when a client's connection to a server is considered untrusted, despite the chain of certificates being complete. This issue is not related to the certificate chain being incomplete or a hostname mismatch, but rather the client refusing to trust the root certificate at the end of that chain.
To understand this error, it's crucial to differentiate between two aspects of certificate validation: building a path and checking the anchor. The client first constructs a chain from the server's certificate up to the root, which should be trusted. Then, it verifies if the root certificate is one that the client trusts, as it is stored in the client's trust store (operating system or browser).
When NET::ERR_CERT_AUTHORITY_INVALID is encountered, it means the server's certificate chain may be complete, but the root certificate is not recognized by the client's trust store. This can be caused by a self-signed certificate, a private or internal CA not installed on the client, a TLS-inspecting proxy or antivirus re-signing traffic, or a chain leading to an untrusted root.
Common scenarios include self-signed certificates on localhost, local appliances, or staging environments. They are valid certificates but are rejected by most clients because they are self-signed, and the trust store does not recognize the self-signed root. Additionally, internal CAs used by companies for internal devices might work on managed devices but fail on unmanaged devices or CI runners due to the lack of the internal root in the client's trust store.
Corporate middleboxes or antivirus products that re-sign TLS traffic can also trigger this error. The certificate chain may appear complete, but if the re-signing CA is not installed on the client, the connection will be rejected. Lastly, a chain terminating at an untrusted root due to removal, cross-sign, or platform differences can also lead to this error.
To diagnose and resolve NET::ERR_CERT_AUTHORITY_INVALID, it's essential to examine the server's chain of certificates, identify the root's status, and ensure the client's trust store contains the correct root. Using tools like openssl s_client -connect example.com:443 -servername example.com -showcerts can help users visualize the certificate chain and the verification process, uncovering the cause of the issue and guiding the appropriate steps to rectify it.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
