{
  "id": 3077700,
  "title": "NET::ERR_CERT_AUTHORITY_INVALID: When the Root Itself Is Not Trusted",
  "url": "https://urgent.news/2026/08/24/net-err-cert-authority-invalid-when-the-root-itself-is-not-trusted",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-24T18:10:38.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/merlonix/neterrcertauthorityinvalid-when-the-root-itself-is-not-trusted-4c18"
  },
  "original_language": "en",
  "account": "The error NET::ERR_CERT_AUTHORITY_INVALID occurs when a client's connection to a server is considered untrusted, despite the chain of certificates being complete. This issue is not related to the certificate chain being incomplete or a hostname mismatch, but rather the client refusing to trust the root certificate at the end of that chain.\n\nTo understand this error, it's crucial to differentiate between two aspects of certificate validation: building a path and checking the anchor. The client first constructs a chain from the server's certificate up to the root, which should be trusted. Then, it verifies if the root certificate is one that the client trusts, as it is stored in the client's trust store (operating system or browser).\n\nWhen NET::ERR_CERT_AUTHORITY_INVALID is encountered, it means the server's certificate chain may be complete, but the root certificate is not recognized by the client's trust store. This can be caused by a self-signed certificate, a private or internal CA not installed on the client, a TLS-inspecting proxy or antivirus re-signing traffic, or a chain leading to an untrusted root.\n\nCommon scenarios include self-signed certificates on localhost, local appliances, or staging environments. They are valid certificates but are rejected by most clients because they are self-signed, and the trust store does not recognize the self-signed root. Additionally, internal CAs used by companies for internal devices might work on managed devices but fail on unmanaged devices or CI runners due to the lack of the internal root in the client's trust store.\n\nCorporate middleboxes or antivirus products that re-sign TLS traffic can also trigger this error. The certificate chain may appear complete, but if the re-signing CA is not installed on the client, the connection will be rejected. Lastly, a chain terminating at an untrusted root due to removal, cross-sign, or platform differences can also lead to this error.\n\nTo diagnose and resolve NET::ERR_CERT_AUTHORITY_INVALID, it's essential to examine the server's chain of certificates, identify the root's status, and ensure the client's trust store contains the correct root. Using tools like openssl s_client -connect example.com:443 -servername example.com -showcerts can help users visualize the certificate chain and the verification process, uncovering the cause of the issue and guiding the appropriate steps to rectify it.",
  "summary": "The hostname matches. The chain is complete — every intermediate is present, each certificate signs the next, and it all leads up to a single certificate at the top. The dates are fine. And the browser still slams the door: Your connection is not private NET::ERR_CERT_AUTHORITY_INVALID Every stack says it in its own accent. Chrome and Edge say NET::ERR_CERT_AUTHORITY_INVALID . Firefox says…",
  "key_points": [
    "NET::ERRCERTAUTHORITYINVALID occurs when client refuses to trust root certificate.",
    "Root certificate not recognized by client's trust store.",
    "Causes include self-signed certs, private CAs, or untrusted roots."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}