# Fixing "Your connection is not private" errors

> What browser SSL warnings like NET::ERR_CERT_COMMON_NAME_INVALID and "Not secure" mean, and how to fix each one.

Source: https://helpcenter.ruachost.com/ssl-security/ssl-troubleshooting/connection-not-private-errors/

If visitors see **"Your connection is not private"**, **"Warning: Potential Security Risk Ahead"** or **"Not secure"** on your site, the browser doesn't trust its SSL setup. The error code under the message tells you why.

## Find the cause

| Error you see | What it means | Fix |
| --- | --- | --- |
| `NET::ERR_CERT_COMMON_NAME_INVALID` / `SSL_ERROR_BAD_CERT_DOMAIN` | The certificate doesn't cover this exact address, often `www` or a subdomain | [Get a certificate for that name](#the-certificate-doesnt-cover-this-address) |
| `NET::ERR_CERT_DATE_INVALID` | The certificate has expired, or the visitor's device clock is wrong | [Renew or reissue it](#the-certificate-has-expired) |
| `NET::ERR_CERT_AUTHORITY_INVALID` | The certificate is self-signed, or the intermediate (CA bundle) is missing | [Install a trusted certificate](#the-certificate-isnt-trusted) |
| **"Not secure"** in the address bar, but no full-page warning | The page loads over `http://`, or some content on it does | [Force HTTPS and fix mixed content](#not-secure-label-only) |

## The certificate doesn't cover this address

1. In cPanel, open **SSL/TLS Status** and check that both `example.com` and `www.example.com` (and any subdomain you use) have a green padlock.
2. If one is red, its DNS probably doesn't point to your hosting yet. Fix the DNS record, then click **Run AutoSSL**. See [Why AutoSSL didn't issue a certificate](https://helpcenter.ruachost.com/ssl-security/ssl-troubleshooting/autossl-not-issuing/).
3. If you use a paid certificate, check it includes this name. A standard certificate covers `example.com` and `www.example.com`; other subdomains need a **wildcard** certificate or their own certificate.

## The certificate has expired

- **Free SSL (AutoSSL):** it renews itself unless something blocks it. Open **SSL/TLS Status**, click **Run AutoSSL**, and check for errors.
- **Paid SSL:** renew it in the client area under **Services → My Services**, then install the new certificate.
- **Only one visitor sees this?** Their device's date and time are probably wrong. Ask them to correct it.

## The certificate isn't trusted

- A **self-signed** certificate is never trusted by browsers. Replace it with the free AutoSSL certificate: open **SSL/TLS Status** and click **Run AutoSSL**.
- For a **paid** certificate, the CA bundle may be missing. Reinstall it in **SSL/TLS → Manage SSL sites** and click **Autofill by Certificate**, which adds the bundle. See [How to get the intermediate CA bundle](https://helpcenter.ruachost.com/ssl-security/ssl-certificates/how-to-get-the-intermediate-ca-bundle/).

## "Not secure" label only

The certificate is fine, but the page isn't fully using it:

1. [Force HTTPS](https://helpcenter.ruachost.com/ssl-security/ssl-certificates/how-to-force-redirect-http-to-https-using-htaccess/) so visitors always reach `https://`.
2. [Fix mixed content](https://helpcenter.ruachost.com/ssl-security/ssl-certificates/mixing-of-secure-and-insecure-content-on-a-web-page/), so every image and script loads over `https://`.

## Using Cloudflare?

Cloudflare shows its own certificate to visitors. Check Cloudflare's **SSL/TLS** settings, and see [Troubleshooting Cloudflare connections](https://helpcenter.ruachost.com/add-ons/cloudflare/troubleshooting-cloudflare-connections/).

Still seeing the error? [Open a support ticket](https://dashboard.ruachost.com/submitticket.php) with your domain and a screenshot of the error.