Fix ERR_CERT_AUTHORITY_INVALID in Chrome

If Chrome shows ERR_CERT_AUTHORITY_INVALID, it means the website’s security certificate was not issued by a certificate authority (CA) that your browser trusts. The fix is usually one of three things: update your computer’s date and time, install the correct root certificate, or (if you run the site yourself) fix the server’s certificate chain.

What This Error Actually Means

Every HTTPS website presents a digital certificate to prove its identity. That certificate is signed by a certificate authority — a trusted middleman like DigiCert, Let’s Encrypt, or GlobalSign. Your browser keeps a list of root certificates from these authorities. When the chain of signatures between the website’s certificate and a root certificate is broken, Chrome throws ERR_CERT_AUTHORITY_INVALID.

The error is different from ERR_CERT_DATE_INVALID (expired or not-yet-valid dates) or ERR_CERT_COMMON_NAME_INVALID (name mismatch). Here, the problem is trust: Chrome cannot trace the certificate back to a source it believes in.

Why It Happens: Common Causes

Wrong system clock — if your device’s date or time is off by more than a few hours, certificate validity checks fail, which can surface as an authority error.
Missing intermediate certificate — the server sent only its leaf certificate, not the chain that connects it to a root CA.
Corporate or school proxy — network security software intercepts HTTPS traffic and presents its own certificate, which your browser doesn’t trust by default.
Antivirus or firewall scanning — similar to a proxy, some security suites inject their own CA.
Self-signed certificates — a server using a certificate it created itself, with no CA signature.
Outdated root store — your operating system hasn’t received recent updates that add new root CAs.

Fix 1: Check Date and Time

This is the simplest and most common fix. If your clock is off, certificate validity checks fail even for perfectly configured sites.

On Windows: right-click the clock in the taskbar → Adjust date/time → toggle Set time automatically and Set time zone automatically on.
On macOS: System Settings → General → Date & Time → enable Set time and date automatically.
On Android: Settings → System → Date & time → enable Use automatic date & time.
On iOS: Settings → General → Date & Time → enable Set Automatically.

After correcting the time, restart Chrome and try the site again.

Fix 2: Clear Chrome’s SSL State (Windows)

Windows caches certificates and can hold onto corrupted entries. Clearing the SSL state forces a fresh validation.

Open Control Panel → Internet Options (or search “Internet Options” in the Start menu).
Go to the Content tab.
Click Clear SSL state.
Click OK and restart Chrome.

This does not delete your browsing history or passwords — only the cached certificate data.

Fix 3: Install the Missing Root or Intermediate Certificate

If the error happens on a site you control (or your organization’s internal site), the server may be sending an incomplete chain. You need to obtain the correct intermediate certificate from your CA and install it on the server. For most hosting panels (cPanel, Plesk, Nginx, Apache), there is a field for “CA bundle” or “intermediate certificate.”

If you’re a user encountering this on a legitimate public site, you can sometimes manually install the missing root certificate, but this is risky. Only do this if you are absolutely sure the site is genuine and you understand the security implications. To view the certificate chain in Chrome:

Click the padlock icon in the address bar (or the “Not secure” warning).
Click Connection is secure (or the warning text).
Click Certificate is valid (or “Certificate information”).
In the Certification Path tab, see if any certificate shows a yellow warning icon.

If an intermediate is missing, you can download it from the CA’s website and install it into your system’s root store — but again, only for sites you trust completely.

Fix 4: Bypass for Testing (Not Recommended for Daily Use)

Chrome offers a temporary “Proceed to site” link on the error page, but it’s hidden. You can click Advanced → Proceed to [site] (unsafe). This bypasses the warning for that visit only. Do not use this for banking, shopping, or entering any personal data — the connection is not properly encrypted against interception.

A better alternative for developers is to run Chrome with the --ignore-certificate-errors flag, but that disables all certificate validation for the entire session and should never be used for normal browsing.

How to Prevent It on Your Own Website

If you run a website and visitors see this error, the problem is almost certainly a misconfigured server. Check these:

Ensure the certificate file includes the full chain (leaf + intermediates) in the correct order.
Use a free tool like SSL Labs’ SSL Server Test to diagnose chain issues.
Renew certificates before they expire — many CAs now offer auto-renewal.
If you use a reverse proxy (like Nginx or HAProxy), make sure it’s configured to forward the full chain.

Frequently Asked Questions

Why does this error appear on my own computer but not on my phone?

Different devices have different root stores and different system clocks. Your phone may have a more recent root certificate or a correctly synced time, while your computer’s clock is off or its OS hasn’t been updated. Check both date/time and OS updates on the failing device.

Is it safe to click “Proceed to site”?

No. That bypasses certificate validation entirely, meaning the connection could be intercepted by a third party. Only use it if you are absolutely certain the site is legitimate (e.g., a test server you control) and you are not entering sensitive data.

Does clearing the SSL state delete my passwords?

No. The SSL state is a cache of certificate validation results, not your saved credentials. Clearing it only forces Chrome to re-validate certificates on the next visit.

Can a VPN cause this error?

Yes. Some VPNs or network proxies intercept HTTPS traffic. If the VPN’s certificate isn’t trusted by your system, Chrome will show this error. Try disconnecting the VPN and reloading the page.

How do I update my root certificates on Windows?

Windows updates include root certificate updates. Go to Settings → Windows Update and check for updates. You can also manually download the latest root update package from Microsoft’s support site, but regular updates should suffice.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →