A dual-use certificate lists both server and client authentication in the same certificate. Chrome's root program rejects one issued on or after March 15, 2027. Here's what the two settings mean, how to check your own certificate in one command, and what over 118 million already-issued certificates mean for you.
Chrome's red-shield warning explained. Map each NET::ERR_CERT_* error code to its cause and fix - including the distrusted-legacy-root cause behind most current AUTHORITY_INVALID errors, and the separate risk of CA-side compliance revocations.
Two reasons Chrome and Brave throw NET::ERR_CERT_AUTHORITY_INVALID: distrusted legacy roots (SSL.com 2016, DigiCert G1, Entrust) - the live, current cause - and CA-side compliance revocations, illustrated by a mid-sized CA's forced revocation of 63,525 certificates in July 2026. CA-agnostic diagnostics and fix steps.
Your SSL certificate works in Firefox and Safari but Chrome and Brave throw NET::ERR_CERT_AUTHORITY_INVALID? The real cause is almost always a distrusted legacy root - plus a separate, growing risk of CA-side compliance revocations. What to ask your CA to reissue.
Subscribe via RSS.