A mid-sized public CA's internal compliance documentation fell out of sync with its issuance system, forcing two separate mass revocations in July 2026. What happened, why it isn't a HARICA-specific problem, and how to check whether you're exposed to the next one.
Microsoft Edge inherits Chromium's TLS validation, including which CA roots it trusts, and uses the Windows certificate trust store. Map each error to its fix, with attention to Windows-specific trust store and Group Policy specifics.
Brave inherits Chromium's TLS validation, including which CA roots it trusts. Map each NET::ERR_CERT_* error code to its cause and fix, plus a few Brave-specific gotchas (Shields, Tor windows).
Chrome's red-shield warning explained. Map each NET::ERR_CERT_* error code to its cause and fix - including the distrusted-legacy-root cause behind most current AUTHORITY_INVALID errors, and the separate risk of CA-side compliance revocations.
Two reasons Chrome and Brave throw NET::ERR_CERT_AUTHORITY_INVALID: distrusted legacy roots (SSL.com 2016, DigiCert G1, Entrust) - the live, current cause - and CA-side compliance revocations, illustrated by a mid-sized CA's forced revocation of 63,525 certificates in July 2026. CA-agnostic diagnostics and fix steps.
Your SSL certificate works in Firefox and Safari but Chrome and Brave throw NET::ERR_CERT_AUTHORITY_INVALID? The real cause is almost always a distrusted legacy root - plus a separate, growing risk of CA-side compliance revocations. What to ask your CA to reissue.
Subscribe via RSS.