Troubleshooting SSL errors in the browser

Why Does an SSL Error Appear in the Browser?

When a user encounters an SSL error in the browser, the first reaction is usually "it's a browser problem" or "the certificate is corrupted." But in most cases, the root of the problem lies elsewhere: an incomplete certificate chain, hostname mismatch, or an expired certificate. In this article, we will examine all three scenarios in technical detail and provide practical solutions for each. If you are a site administrator or work on cloud infrastructure, this guide will help you identify and fix SSL errors in the shortest possible time.

1. Incomplete Certificate Chain

The certificate chain is the path that leads from the server certificate to the root certificate (Root CA). If this chain is incomplete, the browser cannot verify the certificate's validity and displays an SSL error. This issue often occurs when intermediate certificates are not installed on the server.

How to Check the Chain?

You can check the certificate chain from the server's perspective with the following command:

openssl s_client -connect example.com:443 -showcerts

The output of this command includes all certificates sent by the server. If you only see one certificate (the server certificate) in the output and no intermediate certificates, the chain is incomplete. Pay attention to the Certificate chain sections in the output. If you only see one BEGIN CERTIFICATE block, the problem is confirmed.

Solution: Install Intermediate Certificates

Most certificate authorities (CAs) provide intermediate certificate files along with the main certificate for download. For the Nginx web server, you need to append the intermediate certificate to the main certificate file:

cat example.com.crt intermediate.crt > fullchain.crt

Then, in the Nginx configuration, change the ssl_certificate path to the fullchain.crt file and restart the service:

sudo systemctl restart nginx

For Apache, also point the SSLCertificateChainFile directive to the intermediate certificate. After making changes, be sure to check again with the openssl s_client command to confirm that at least two or three certificates are being sent in the chain.

2. Hostname Mismatch

Another common cause of SSL errors is a mismatch between the domain name the user enters in the browser and the domain name registered in the certificate. This error is usually displayed with messages like "Invalid security name" or "Certificate not issued for this site."

Types of Mismatches

• Main domain vs. subdomain: The certificate is issued for example.com, but the user visits www.example.com.
• Similar domains: The certificate is for example.com, but the user goes to example.org.
• Direct IP address: The user accesses the site via an IP address, while the certificate is only issued for the domain name.

Checking with the openssl Command

To check which domains the certificate is issued for, use the following command:

openssl x509 -in certificate.crt -noout -text | grep -A 1 "Subject Alternative Name"

The output includes the list of valid domains. If the domain in question is not in this list, the problem lies with the certificate.

Solutions

1. New certificate with the correct domain: If the certificate was issued for the wrong domain, you need to obtain a new certificate with the correct domain name.
2. Set up a redirect: If the certificate is for example.com but users visit www.example.com, set up a 301 redirect from www to the main domain:

server {
    listen 443 ssl;
    server_name www.example.com;
    return 301 https://example.com$request_uri;
}

This ensures users are always directed to the domain for which the certificate is valid.

3. Expired Certificate

SSL certificates have an expiration date and are typically valid for 1 to 2 years. When a certificate expires, the browser displays the "Security certificate has expired" error. This is the simplest issue, but if not detected in time, it can lead to a loss of user trust.

Checking the Expiration Date

You can check the certificate's expiration date remotely with the following command:

echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

The output includes two dates: notBefore (the start date of validity) and notAfter (the expiration date). If the current date is after notAfter, the certificate is expired.

Solution: Automatic Renewal

The best way to prevent this issue is to use automatic renewal. If you use Let's Encrypt, you can set up automatic renewal with the following cronjob:

0 3 * * * certbot renew --quiet --deploy-hook "systemctl reload nginx"

This command checks every day at 3 AM whether the certificate is about to expire (less than 30 days remaining) and renews it if necessary. For certificates purchased from commercial CAs, you can usually set up email reminders or use the CA's API for automatic renewal.

4. Other SSL Errors You Should Know

In addition to the three main issues, there are other errors you may encounter:

Self-Signed Certificate

If the certificate is not issued by a trusted CA (e.g., for a test environment), the browser displays the "Your connection is not private" error. Never use self-signed certificates for production environments. For testing, you can create a self-signed certificate but add it as an exception in the browser.

Old TLS Protocols

If your server only supports TLS 1.0 or TLS 1.1, modern browsers will show an error. To check the supported TLS versions:

openssl s_client -connect example.com:443 -tls1_2

If this command fails, TLS 1.2 is not supported. In Nginx, you can configure the allowed protocols:

ssl_protocols TLSv1.2 TLSv1.3;

System Date Mismatch

If the date and time on the user's (or server's) system are incorrect, the browser may display an SSL error. This issue is less common, but if everything seems correct, check the system date.

5. Helpful Tools for SSL Error Troubleshooting

For faster diagnosis of issues, use the following tools:

• SSL Labs (ssllabs.com): Provides a comprehensive analysis of the certificate and server configuration.
• Why No Padlock (whynopadlock.com): Helps find mixed content that causes SSL errors.
• curl with detailed options: To check errors from the command line:

curl -vI https://example.com 2>&1 | grep "SSL"

This command shows the full details of the handshake process and can identify specific errors such as the inability to retrieve intermediate certificates.

6. Summary and Prevention

SSL errors in the browser typically stem from three main sources: an incomplete chain, hostname mismatch, and expired certificates. By regularly checking these three items, you can prevent errors from occurring. We recommend having a monthly checklist:

1. Check the certificate expiration date with openssl
2. Check the certificate chain with openssl s_client -showcerts
3. Test access with and without www
4. Check the supported TLS versions

If you use cloud infrastructure, ServerNet provides SSL certificate management in the user panel, which can simplify the installation and renewal process. However, in any case, familiarity with these commands and concepts will help you quickly resolve issues in any situation.

Finally, remember that an SSL error is not just an error message; it is a sign of a technical problem that, if not resolved in time, can destroy user trust and even negatively impact your site's SEO. With regular checks and the use of the tools mentioned, you can ensure that your site is always accessible with a secure connection.