NET::ERR_CERT_AUTHORITY_INVALID — Self-Signed or Missing Chain

The browser doesn't trust the certificate as presented: it's self-signed, issued by an untrusted CA, or (the sneaky one) the intermediate chain is missing. The fix differs per cause.

What you'll see

Root causes

Self-signed / internal CA not trusted by the client

Legit inside companies: install the internal CA on clients, or issue per-service certs from your CA. For public sites, use Let's Encrypt/Cloudflare Origin CA instead.

Missing intermediate certificate (very common)

You installed only the leaf cert. Browsers with AIA fetching hide it; Android, curl, Python, and Java fail. openssl s_client -connect host:443 -showcerts | grep -c 'BEGIN CERT' — 1 means chain problem.

Mixed private/PKI or expired intermediate

A valid-looking leaf chained to an intermediate that itself is untrusted/expired — same error, check the -issuer chain.

Fix it

  1. See the exact chain your server presents
    openssl s_client -connect your.host:443 -servername your.host -showcerts </dev/null 2>/dev/null | grep -E 's:|i:'
  2. Serve fullchain (leaf + intermediates)
    # nginx: ssl_certificate /etc/letsencrypt/live/your.host/fullchain.pem   # NOT cert.pem
  3. For internal services: trust the CA on clients deliberately
    # macOS: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ca.pem ; Linux: /usr/local/share/ca-certificates + update-ca-certificates
  4. For public hostnames: issue from a real CA for free
    sudo certbot --nginx -d your.host   # 5 minutes, auto-renewing, kills this error for everyone

Field note

The fullchain-vs-leaf mistake is the #1 cause of 'works on desktop, breaks on mobile/API' cert errors. SSL Labs (ssllabs.com/ssltest) grades the served chain — chain-incomplete shows immediately.

Common questions

Why does the padlock work in Chrome but Android says the cert is invalid?

Chrome fetches missing intermediates (AIA); Android doesn't. Your server serves only the leaf. Fix: configure fullchain.pem (leaf + intermediates) — correct everywhere.

Is a self-signed cert ever acceptable?

For internal tooling with the CA deliberately trusted on clients, yes. For anything public or team-wide without that trust story, use Let's Encrypt or your provider's managed TLS.

Related fixes

Ship it right the first time

Our most-documented failures, packaged as ready-to-ship starter kits: Docker, Kubernetes, and Terraform.

Browse the template store →

One-time. Yours to modify. Instant download from the NinjaOps template store.