Recommended Free Tools
ERR_CERT_AUTHORITY_INVALID means the browser cannot build a trusted certificate chain for your site. The usual server-side fix is to install a certificate issued by a trusted certificate authority (CA) and configure the server to send the website certificate together with every required intermediate certificate. If the site works on one device but not another, investigate local trust stores, antivirus HTTPS scanning, corporate proxy interception, operating-system updates, and the system clock before replacing the server certificate. Do not make a public site “work” by telling visitors to accept the warning or add a permanent exception.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What ERR_CERT_AUTHORITY_INVALID means
When a browser opens an HTTPS address, it validates more than the certificate attached to the domain. It tries to build a chain of trust:
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
website certificate → intermediate CA certificate(s) → trusted root CA
Chrome uses the Chrome Root Store together with local operating-system and enterprise settings. Firefox performs the same basic validation against its trusted roots. The browser checks that the certificate is currently valid, that the certificate covers the hostname, and that each issuer in the chain can be trusted.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
The authority error appears when that chain cannot be completed. Typical causes include:
- The server sends the leaf (website) certificate but omits one or more intermediate certificates.
- The certificate is self-signed or was issued by a CA that the affected device does not trust.
- A trusted root is missing or outdated in the client trust store.
- The certificate has expired or is not yet valid.
- An antivirus product or corporate proxy has replaced the public certificate with its own inspection certificate, but its root is not installed locally.
A hostname mismatch is a different certificate failure. Inspecting the certificate name is still important because it prevents you from trying to repair an authority problem when the real issue is that the certificate does not include the requested domain.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Establish whether the problem is on the server or one client
Do not change DNS, renew a certificate, or disable security software until you know how broadly the error occurs. Test the exact HTTPS URL in a normal window and an Incognito or Private window, then repeat from another browser, another device, and another network such as cellular data.
| What you observe | Most likely area | Next action |
|---|---|---|
| Every browser and device reports the error | Server certificate, missing intermediate, expired certificate, or untrusted issuer | Inspect the served chain and correct the web-server or hosting-panel configuration. |
| Only one computer fails while phones and other computers work | Local root store, system clock, antivirus HTTPS inspection, or a stale operating system | Update the operating system, check the clock, and test with HTTPS scanning disabled only as a controlled diagnostic. |
| Only an office or school network fails | TLS interception by a managed proxy | Ask the network administrator which interception root is required; do not install an unknown certificate. |
| New devices work but an older device fails | The older trust store does not contain a compatible root or cannot build the selected chain | Review alternate chains and the device’s supported root certificates. |
| The error began immediately after renewal | Wrong certificate, incomplete chain, or an installation that was not applied to every HTTPS endpoint | Compare the served certificate and chain with the files deployed during renewal. |
If the result changes in a Private window, also check locally installed extensions and cached policy. A Private-window result does not prove the server is healthy; it only narrows the client-side possibilities.
Inspect the certificate before editing configuration
Use the browser’s certificate viewer. In Chromium-based browsers, open the site information control beside the address, choose the connection or certificate details, and open the certificate viewer. Firefox exposes certificate information from its connection-security panel. Labels vary by browser version, but the fields you need are consistent.
- Record the subject and the Subject Alternative Name entries. Confirm that the exact hostname you typed is covered, including whether it is the apex domain or a subdomain.
- Record the issuer. An issuer belonging to your company or security appliance, rather than the public CA you expected, indicates local or network interception.
- Check the valid-from and expiration dates against the current date and time.
- Expand the certificate chain. Identify the leaf certificate, each intermediate, and the root that the browser is trying to use.
- Note the exact error text and whether it is authority-related, expired, not-yet-valid, or a name mismatch.
Take a screenshot or export the public certificate details for comparison, but never share the private key. The certificate viewer shows what that particular client received; a second device can receive a different chain when a proxy is involved.
Fix the server by sending the complete chain
Install the leaf certificate and intermediates together
A public web server should normally send the website certificate followed by every intermediate certificate needed to reach a root already trusted by the browser. Let’s Encrypt explains that an ACME download includes a chain and that presenting the whole chain allows clients to validate to a trusted root. Sending only the leaf certificate is a common reason a site works in one browser but fails elsewhere.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
In your hosting panel, look for a certificate installation or SSL/TLS section. The fields may be called certificate, private key, and CA bundle or certificate chain. Paste or upload the leaf certificate in the certificate field and the intermediate bundle in the chain field. Do not paste the private key into a public certificate or chain field.
Example for Nginx
Nginx normally expects the certificate file referenced by ssl_certificate to contain the leaf certificate followed by the intermediate certificates in the correct order. A typical server block is:
server {
listen 443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/ssl/example/fullchain.pem;
ssl_certificate_key /etc/ssl/example/privkey.pem;
}The filenames are examples; use the paths created by your certificate client or hosting provider. After replacing the files, run the configuration test supplied by your installation and reload Nginx. A reload is preferable to a full stop because it allows existing connections to finish, but follow your host’s documented procedure.
Example for Apache HTTP Server
Apache installations differ by version and distribution. The relevant virtual-host settings generally identify the leaf certificate, private key, and chain file:
SSLCertificateFile /etc/ssl/example/certificate.pem
SSLCertificateKeyFile /etc/ssl/example/privatekey.pem
SSLCertificateChainFile /etc/ssl/example/chain.pemSome current Apache builds accept a combined full-chain file in SSLCertificateFile and do not require a separate chain directive. Check the documentation for the Apache version supplied by your operating system, validate the configuration, and reload the service.
Other web servers and managed hosting
IIS, reverse proxies, container ingress controllers, CDNs, and managed hosting products use different import screens. The principle is unchanged: bind the certificate to the correct HTTPS listener, import the intermediate certificates into the required chain or intermediate store, and make sure every edge location serves the updated deployment. If a provider offers an automatic certificate installer, confirm that it installed a full chain rather than only the leaf certificate.
After deployment, open the site from a network that is not your administration network. A successful page load from the server itself is not sufficient when that server uses a local trust store that differs from visitors’ devices.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Choose a chain that the affected devices trust
There can be more than one valid path from an intermediate certificate to a root. A chain that works on current browsers can fail on an older operating system if that device lacks the selected root. Conversely, a chain chosen for legacy compatibility can create problems on platforms that no longer trust an older root.
Let’s Encrypt documents compatibility differences involving ISRG Root X1 and ISRG Root X2. If only certain platforms fail, the problem is often the chain served by the site rather than the validity of the leaf certificate. Compare the affected platforms’ trust stores with the available chain choices from your CA or ACME client.
- List the browsers, operating systems, embedded devices, and network appliances that must connect to the site.
- Check which root certificates those environments trust and whether they support the certificate signature algorithms and key sizes used by your CA.
- Use the CA’s documented alternate-chain option, when available, to select a path compatible with the oldest supported environment.
- Deploy the chosen full chain and test both the newest and oldest representative clients.
Do not assume that a certificate labeled “valid” in one certificate viewer is universally compatible. Compatibility is a property of the complete chain and the client trust store.
When only one computer or network fails
Correct the system clock
Certificate validity depends on the client’s date and time. If the clock or time zone is substantially wrong, a currently valid certificate can appear expired or not yet valid. Enable automatic time synchronization through the operating system, then restart the browser and test again.
Install operating-system updates
Chrome recommends updating the operating system when certificate errors persist. Trust stores are updated through operating-system maintenance, so an old installation may lack a current root even though the browser itself is up to date. Apply supported security updates, reboot if required, and retest before manually importing certificates.
Check antivirus HTTPS scanning
Google Chrome Help specifically notes that antivirus software providing “HTTPS protection” or “HTTPS scanning” can trigger this error. Such products create a local interception certificate and decrypt traffic for inspection. Temporarily turn that feature off only to confirm the diagnosis, then turn it back on and install the vendor’s documented local root certificate or create an approved exception. Do not leave HTTPS scanning disabled as a general remedy.
Check a corporate or school proxy
Managed proxies can terminate TLS and issue a replacement certificate for each visited site. Enterprise products such as Zscaler, Palo Alto Networks, and Fortinet commonly use this model. The organization must distribute its interception root through managed device policy. A user should not download a root certificate from an email or an arbitrary web page, because installing a malicious root allows its holder to impersonate any HTTPS site.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Refresh a stale local trust store
If the organization has recently changed its CA or proxy, confirm that device-management policy completed successfully. Remove duplicate or obsolete enterprise roots only under administrator guidance; deleting a root can break other internal services. For a public website, fixing the server chain is preferable to asking every visitor to modify a trust store.
Renew or replace the certificate when the certificate itself is wrong
Obtain a new certificate from a CA trusted by the browsers and devices you support when any of these conditions applies:
- The certificate is expired or has a future validity start date caused by a clock or issuance problem.
- The certificate is self-signed and the service is intended for the public internet.
- The issuing CA is not trusted by the target clients.
- The certificate does not include the required hostname.
- The private key and certificate do not match, or the certificate was installed on the wrong HTTPS listener.
- The renewal process replaced the leaf certificate but left an old or incomplete intermediate chain in production.
For automated environments, ACME clients can request and renew certificates without manual reissuance. Let’s Encrypt provides automated ACME issuance and documents chain selection. Automation does not remove the need to reload the web server, deploy the full chain, and test the result after each renewal.
Commercial CAs and managed hosting services should be evaluated on the same practical criteria rather than on the brand name alone:
| Evaluation axis | Questions to ask |
|---|---|
| Browser and device compatibility | Which roots and alternate chains are trusted by the oldest clients you support? |
| Complete-chain handling | Does the service deliver and install the intermediate bundle automatically? |
| Renewal automation | Can issuance, deployment, and web-server reloads run unattended with failure notifications? |
| Alternate chains | Can you choose a different chain when a platform has a missing or retired root? |
| Validation and identity | Do you need domain validation only, or organizational identity checks for your use case? |
| Monitoring | Are expiry, chain changes, hostname coverage, and failed renewals monitored? |
| Total operating cost | Include certificate fees, deployment labor, monitoring, support, and the cost of outages. |
Retest the public result
Use an independent TLS analysis service such as SSL Labs after every chain change. Mozilla Support recommends SSL Labs when a site you own reports Chain issues: Incomplete. The report should show the expected leaf certificate, the intermediate certificates in order, and successful validation from the client profiles relevant to your audience.
Run the test from representative conditions:
- A current Chromium-based browser and a current Firefox release.
- An updated desktop operating system and a phone or tablet.
- The oldest still-supported operating system or embedded client.
- A network outside your corporate proxy.
- Your corporate network, if users are expected to connect through TLS inspection.
Check every hostname and endpoint that terminates HTTPS, including www, the apex domain, API subdomains, administration portals, and CDN or load-balancer addresses. A correct certificate on one listener does not repair another listener with an old configuration.
Why bypassing the warning is not a website fix
Browsers expose options such as Advanced and Accept the Risk for exceptional cases. Mozilla warns that an invalid certificate can indicate fraud or interception and that permanent exceptions weaken security. A visitor who bypasses the warning may be connecting to an impostor, an intercepted session, or a server whose identity cannot be verified.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
For a private development service or an intentionally internal application, an administrator can distribute the organization’s root certificate through controlled device management. That is an explicit trust decision for a known group of devices, not a solution for a public website. Public visitors should receive a certificate that their browsers trust without special instructions.
Use the symptom to choose the repair
All clients fail after a certificate renewal
Open the certificate viewer from an outside network and compare the served leaf and chain with the files created by the renewal job. Correct the binding, restore the intermediate bundle, reload every TLS terminator, and rerun the external analysis.
Free tools Windows power users keep installed
One-click scans. No signup required.
Only older clients fail
Identify the missing or retired root in those clients, then evaluate an alternate chain from the CA. If the clients cannot support any compatible public chain, document the minimum supported platform instead of weakening validation for everyone else.
Only the office network fails
Compare the issuer shown inside and outside the office. If the office sees an enterprise issuer, have the network team verify distribution of its interception root and inspect policy failures. Do not alter the public certificate solely to accommodate a broken internal policy.
The browser reports a hostname mismatch
Stop treating it as an authority-chain problem. Request or select a certificate whose Subject Alternative Name includes the exact hostname, then bind that certificate to the listener handling the request.
The error appears intermittently
Different load-balancer nodes, CDN edges, or IPv4 and IPv6 endpoints may be serving different certificates. Query each endpoint and compare the leaf, issuer, expiration, and chain. Deploy one consistent configuration, or fix the node that missed the renewal.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsPrevent the error from returning
Document which service requests the certificate, where the private key and full-chain files are deployed, which process reloads after renewal, and which hostnames are covered. Store the public chain and deployment configuration in a controlled change record; protect private keys with the access controls required by your organization.
Configure monitoring that checks expiry, hostname coverage, chain completeness, and changes in the served issuer. Have the alert reach someone who can renew the certificate and reload the correct listener, not merely someone who can view the dashboard. After changing a CA, proxy, CDN, load balancer, or operating-system image, repeat tests from both modern and legacy clients before declaring the change complete.
The durable fix is therefore specific: serve a currently valid certificate for the requested hostname, include the complete intermediate chain, select a path trusted by the devices you support, and repair local or enterprise trust problems only on the clients you control.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
