Why does Brave show 'Your connection is not private'?

Because Brave is built on Chromium and inherits Chrome's TLS validation. The warning means the site's certificate failed one of three checks - validity dates, hostname coverage, or chaining to a trusted CA. The NET::ERR_CERT_* code and the fixes are the same as in Chrome.

Are Brave's SSL errors the same as Chrome's?

Yes. Brave uses the same Chromium validation code, error-code vocabulary, and trust decisions, so a configuration that satisfies Chrome satisfies Brave. Brave's privacy features (Shields, Tor windows) sit on top and do not change SSL validation.

The page is partly broken in Brave but there's no certificate error - why?

That is usually Brave Shields, not an SSL problem. Shields can block third-party resources like scripts, ads, and some images, so the page looks broken while the certificate is fine. Check the Shields settings for that site.

How do I fix NET::ERR_CERT_AUTHORITY_INVALID in Brave?

Run 'openssl s_client -showcerts -connect example.com:443' and read the issuer lines. If the chain terminates at a legacy root your CA has migrated away from, request reissuance from their current hierarchy. If it is a self-signed or internal certificate, switch to a publicly-trusted CA.

Fix Browser Security Warnings in Brave

Brave is built on Chromium, so the SSL warnings you see are nearly identical to Chrome's - same wording, same error codes, same underlying validation logic. This guide covers what Brave's "Your connection is not private" warning means and how to fix it.

Why Brave's warnings look like Chrome's

Brave is a Chromium-based browser. Most of its TLS validation, error reporting, and trust store handling comes from the same code that Chrome uses. When you see "Your connection is not private" in Brave, it's the same check that Chrome would have failed.

Two practical implications:

The error codes you see (NET::ERR_CERT_DATE_INVALID, NET::ERR_CERT_COMMON_NAME_INVALID, etc.) are identical to Chrome's.
The fixes are identical too. A configuration that satisfies Chrome will satisfy Brave.

Brave does add some privacy-focused features on top (Tor windows, Brave Shields), but those don't change the SSL validation logic.

What the warning means

Brave is refusing to establish a trusted HTTPS connection because something about the site's SSL certificate failed validation. Three checks must all pass:

The certificate is currently valid (not expired, not before its start date).
The certificate covers the hostname being requested.
The certificate's issuer chains up to a trusted CA in the system trust store.

The error codes you'll see (same as Chrome)

NET::ERR_CERT_DATE_INVALID - expired or not-yet-valid certificate.
NET::ERR_CERT_COMMON_NAME_INVALID - hostname doesn't match the certificate.
NET::ERR_CERT_AUTHORITY_INVALID - issuer not trusted (often self-signed).
NET::ERR_SSL_VERSION_OR_CIPHER_MISMATCH - server's TLS version or ciphers are too old.
NET::ERR_CERT_REVOKED - certificate has been revoked.

If you're a visitor seeing this warning

Default action: leave the site. The warning is real - trust is broken, and entering passwords or payment information is risky.

Reasonable exceptions:

The site is yours - use the fixes below.
The site is an internal tool with a known internal-CA certificate. Get the CA installed on your system; don't click through ad hoc.
Your system clock is wrong - Brave (like all browsers) trusts the system clock to determine certificate validity. A wrong clock makes valid certificates look expired.

If you own the site and need to fix it

For NET::ERR_CERT_DATE_INVALID (expired)

Issue a new certificate. The quickest path is a free Let's Encrypt certificate via Beacon:

Need a working certificate right now?

Beacon issues free 90-day Let's Encrypt certificates with a guided DNS-validation flow. No account, no command-line tools, no ACME client to install - just a domain you control. Most people get a working certificate in under 10 minutes.

Get a free certificate from Beacon

For NET::ERR_CERT_COMMON_NAME_INVALID (hostname mismatch)

Your certificate doesn't include the affected hostname on its SAN list. Either issue a new certificate that covers it, or fix your server's SNI configuration to map the right certificate to the right hostname. Watch out for wildcard-depth: *.example.com doesn't cover api.eu.example.com.

For NET::ERR_CERT_AUTHORITY_INVALID (untrusted issuer)

Your certificate is from an issuer that isn't in the trust store. Most often a self-signed certificate, an internal CA, or - because Brave inherits its trust decisions from Chromium - a certificate chaining to a root Chrome has stopped trusting under routine root lifecycle policy.

Check which root your certificate chains to

This is the most common live cause of this error in 2026. Check with:

echo | openssl s_client -showcerts -servername example.com -connect example.com:443 2>/dev/null \
  | grep -E "(s:|i:)"

If the issuer is a legacy root your CA has migrated away from, ask for reissuance from their current hierarchy. The deep dive on the real causes of NET::ERR_CERT_AUTHORITY_INVALID in 2026 covers the specific distrusted roots and current replacements per CA.

A separate risk: CA-side compliance revocation

Chrome will eventually reject certificates mixing serverAuth and clientAuth Extended Key Usages, but not until March 15, 2027 - that's not live browser behavior yet. The nearer-term risk is a CA revoking a certificate on short notice because its own internal compliance deadline (not Chrome's) was missed. It happened to tens of thousands of certificates in July 2026. Read about the incident and how to check whether you're exposed.

For self-signed or internal-CA cases

Switch to a publicly-trusted CA like Let's Encrypt, DigiCert, or Sectigo. Beacon issues free Let's Encrypt certificates in about 10 minutes for urgent replacements.

For NET::ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Your server is too restrictive on TLS version or cipher suites. Modern browsers (including Brave) require TLS 1.2 minimum and reject deprecated ciphers. The Mozilla SSL Configuration Generator produces ready-to-paste configurations.

Brave-specific things to check

Two Brave-specific configurations occasionally cause confusion:

Brave Shields blocking content - if the page partially loads but resources are missing, check Shields settings. Shields can block third-party resources (including some images and scripts) and the page may look broken without an actual SSL issue.
Tor windows - Brave's private window with Tor changes the network path to the site. If certificates work in regular Brave but not Tor windows, the issue is usually a server-side restriction on Tor exit nodes (or your origin server rejecting unfamiliar geo locations).

Prevent this from happening again

Stop this from happening again

TLS Radar continuously monitors every certificate across your domains and alerts you weeks before anything expires, and also catches the silent failure modes - chain breaks, weak ciphers, hostname mismatches, risky EKUs, and distrust events - that keep a site from opening in every browser. Built for solo developers monitoring a handful of sites and for enterprise teams managing thousands of certificates across multiple environments.