SSL and TLS certificate errors

Symptoms

The browser shows an SSL warning or a full error page, or it refuses to load the site: "Your connection is not private", NET::ERR_CERT_COMMON_NAME_INVALID, NET::ERR_CERT_DATE_INVALID, or a mixed-content warning. The site may work over http while https fails, or the padlock may be gone on an inner page.

Common causes

• The certificate does not cover the hostname being visited. The classic case: the certificate covers www.example.com but the visitor loaded example.com, or vice versa. Modern browsers expect both, and NET::ERR_CERT_COMMON_NAME_INVALID names this directly.
• The certificate expired. Free certificates renew automatically only while the automation runs; a paused site, a changed domain, or an email check that stopped can leave a certificate expired.
• Only the apex certificate is valid; subdomains and additional names have no matching cert, so a CDN or a subdomain shows an error.
• A mixed-content page: the page is https but loads images, scripts, or fonts over http. The main connection succeeds; specific resources fail.
• Cloudflare SSL mode is Flexible while the origin redirects http to https, or Full while the origin has no valid cert, causing loops or handshake errors.
• The server's certificate is not signed by a CA the browser trusts (a self-signed or internal CA cert served to the public).

How to fix

1. Read the exact error text. NET::ERR_CERT_COMMON_NAME_INVALID is a hostname coverage problem; NET::ERR_CERT_DATE_INVALID is expiration or clock skew (check both client and server clocks).
2. Verify what the certificate covers. nslookup tells you where the site resolves; openssl s_client -connect example.com:443 or a browser certificate viewer shows the SAN names. If the visited hostname is not in the SAN list, that is the fix target.
3. Set the domain and www to resolve to the same host and cover both hostnames in one certificate. Your hosting or CDN normally issues a single certificate covering example.com and www.example.com.
4. Renew a certificate that stopped auto-renewing. Check the automation (Let's Encrypt/certbot, or your host) and confirm the validation records still point to the right server, especially after a host move.
5. Fix mixed content. Load the page in dev tools, find the http:// requests on the Network tab, and update them to https://. Use protocol-relative or scheme-inheriting URLs so future pages cannot regress.
6. Align SSL mode in Cloudflare with the origin. For a standard origin cert use Full; for a CA-issued origin cert use Full strict. If neither matches because there is no origin cert, use Flexible but ensure nothing on the origin forces http.
7. Replace self-signed certificates on public-facing sites with one from a public CA. Use the host's one-click tool or certbot.

Prevention

• Cover apex and www in a single certificate and test both hostnames after any cert change.
• Renewal automation must be running and email-verified, not just installed.
• Test https on every inner page after going live, not just the home page, so mixed content cannot hide.