` reads). %> Valid SSL Certificate, but Chrome Says 'Not Secure'? Here's Why | TLS Radar Skip to main content
guides 6 min read By TLS Radar Team

Valid SSL Certificate, but Chrome Says 'Not Secure'? Here's Why

If your SSL certificate works in Firefox, Safari, and Edge but Chrome or Brave shows 'Not secure' or NET::ERR_CERT_AUTHORITY_INVALID, the certificate almost certainly did not break - Chrome stopped trusting the root it chains to. Chrome maintains its own root store, separate from other browsers and your operating system, and retires older CA roots on its own schedule. The fix is to reissue from a root Chrome currently trusts and install the full chain; the prevention is monitoring your certificate against the trust stores browsers actually use.

You bought a certificate. You installed it. It worked. Then one day a customer writes: "Your site won't open in Chrome. It says Not secure." You check, and the certificate is fine. It works in Firefox. It works in Safari. It works in Edge. It works on your phone. Only Chrome complains. You didn't change anything.

You're right, you didn't. Something changed on the other side, in a part of the internet most of us never look at: the companies that issue certificates and the rules browsers use to trust them. That world is ambiguous to regular customers, and it's easy to miss a rare email notification from your certificate provider. This guide explains what happened in plain words, how to confirm it in one click, and how to fix it without becoming a certificate expert.

Why only Chrome?

Behind every padlock is a simple idea. Each browser keeps a list of companies it trusts to issue certificates. If your certificate comes from a company on the list, you get the padlock. If not, Chrome shows a warning to your customers instead of landing them on your website.

Here's the part nobody tells you: these lists are not the same from one browser to the next, and Chrome recently started keeping its own. So the company that issued your certificate can still be trusted by Safari, Firefox, and your phone while Chrome has quietly dropped it. Same certificate, different answer. Nothing on your side broke.

Why this keeps happening in 2026

The certificate industry is in the middle of a long cleanup, and the changes land on website owners with very little notice. A few examples from this year, so you can see the pattern:

  • Chrome is phasing out "do-everything" certificates, but not on your browser yet. Chrome Root Program Policy eventually requires website certificates to do one job (TLS server authentication) and nothing else - certificates that also include the client-authentication usage (a common configuration in older "dual-purpose" certs) will stop being accepted, but not until March 15, 2027. Providers are migrating their issuance profiles ahead of that date; DigiCert published its notice ahead of the deadline. The catch: some CAs wrote an earlier internal deadline into their own compliance documents and didn't update it when Chrome extended the industry-wide date - and when that mismatch gets discovered, the CA has to force-revoke every certificate affected, often within days, regardless of what Chrome itself currently enforces.
  • SSL.com is retiring its 2016 roots. Because those older roots were used for the "do-everything" type, SSL.com is moving customers to its newer 2022 roots, which Chrome trusts. Their deadline is May 5, 2026. If your certificate still connects up to a 2016 root, it can lose Chrome's trust while still working elsewhere.
  • DigiCert's older "G1" roots leave Chrome on April 15, 2026. Certificates that rely on them stop being trusted on that day. See DigiCert's G1 root removal advisory.
  • Some providers were dropped completely. Chrome stopped trusting Chunghwa Telecom and NetLock certificates issued after July 31, 2025.

You don't need to remember any of this. The point is simpler, and a little unfair: a decision made far away can switch off your site in Chrome, and you're often the last to know. (If you ever want the official version, Google explains it in its Chrome root program announcement.)

How to tell if this is your problem

Two quick checks, no special tools needed:

  • Open the same page in two browsers. If Firefox or Safari load fine but Chrome shows a warning, that's the giveaway. It's a trust problem, not a broken certificate.
  • Read the small print in Chrome's warning. Click "Advanced." If you see NET::ERR_CERT_AUTHORITY_INVALID, Chrome doesn't trust the company that issued your certificate. That's this exact situation - almost always because the certificate chains to a root that's been dropped from Chrome's trust list. A related but distinct risk: your CA can also force-revoke a certificate on short notice over its own compliance deadlines, independent of anything Chrome enforces. The deep dive on the real causes of NET::ERR_CERT_AUTHORITY_INVALID in 2026 walks through both with diagnostic commands.

The fastest way to know for sure is to check your own domain. Type it below and we'll scan it for you. You'll see, in seconds, whether your certificate is trusted or not.

Check your certificate now

Enter your domain and our free scanner will check whether your certificate is trusted, the same check Chrome runs before it shows the padlock. Results open in a new tab.

How to fix it

The fix is the same no matter which provider caused it: get a certificate that connects up to a list Chrome trusts today, and install the whole chain.

  • Reissue from a current, Chrome-trusted provider. If your provider has moved to newer roots (as SSL.com has with its 2022 roots), ask for a reissued certificate on the new ones. Any well-known provider works in Chrome today: Let's Encrypt, DigiCert, Sectigo, SSL.com's 2022 roots.
  • Install the full chain, not just your certificate. Your server has to send your certificate and the in-between certificates that connect it up to the trusted root. A missing middle piece is its own common cause of "fine for me, broken for them." Swapping only your own certificate isn't enough.
  • Check Chrome and one other browser after you deploy to confirm the warning is gone for everyone.

Need a working certificate right now?

Beacon issues free 90-day Let's Encrypt certificates with a guided DNS-validation flow. No account, no command-line tools, no ACME client to install - just a domain you control. Most people get a working certificate in under 10 minutes.

Get a free certificate from Beacon

In Chrome, "not trusted" means lost customers

If you only read one section, read this one. A browser trust change can take your site offline in Chrome with no warning, and the first you hear of it is customers walking away. TLS Radar watches your certificate around the clock and tells you the moment Chrome, or any major browser, stops trusting it. Create a free account and get the alert before your visitors ever see a warning.

Here's why this is worth taking seriously. Chrome is the browser most of your customers use. By a wide margin, it holds the largest share of personal browsers in the world. When Chrome decides your certificate isn't trusted, it doesn't show a small note. It puts a full-page red warning between your visitor and your website, and tells them it isn't safe to continue.

Think about what that costs. Every person who clicks your link, your ad, or your search result hits a scary security screen and leaves. They don't email you. They just go to a competitor. Your sales drop. Your sign-ups drop. And the visitors who do see the warning start to wonder whether your business can be trusted at all. The damage isn't only today's lost traffic; it's the reputation that's hard to win back.

The worst part is that your certificate didn't expire and you didn't misconfigure anything. A list inside one browser changed, and the first sign of trouble was a customer who couldn't reach you. By then, the lost traffic is already gone.

This is exactly the kind of failure that's invisible until it's expensive, and exactly the kind you can prevent. You shouldn't have to follow browser announcements and provider deadlines just to keep your site open. We watch your certificate against the trust lists browsers actually use, and we warn you the moment one of them stops trusting it, not just when it's about to expire. When the certificate world makes its next sudden change, you hear it from us first, with time to act, instead of from an angry customer.

Stop this from happening again

TLS Radar continuously monitors every certificate across your domains and alerts you weeks before anything expires, and also catches the silent failure modes - chain breaks, weak ciphers, hostname mismatches, risky EKUs, and distrust events - that keep a site from opening in every browser. Built for solo developers monitoring a handful of sites and for enterprise teams managing thousands of certificates across multiple environments.

Sign Up Talk to us about enterprise solutions

Related reading

Frequently asked questions

Why does my SSL certificate work in Firefox but not Chrome?
Because Chrome keeps its own root store, separate from Firefox, Safari, and your operating system. Chrome can drop trust in the CA root your certificate chains to while other browsers still trust it. The certificate itself is unchanged; only Chrome's trust list changed. This produces NET::ERR_CERT_AUTHORITY_INVALID in Chrome and Brave while the site loads fine elsewhere.
Is 'Not secure' in Chrome caused by an expired certificate?
Usually not, if the site still works in other browsers. An expired certificate fails everywhere, not just Chrome. When only Chrome complains, the more likely cause is that Chrome has stopped trusting the root your certificate chains to. Open the page in a second browser to tell the two apart.
How do I fix NET::ERR_CERT_AUTHORITY_INVALID?
Reissue the certificate from a root Chrome currently trusts (any well-known provider works today - Let's Encrypt, DigiCert, Sectigo, or SSL.com's 2022 roots), and install the full chain including the intermediate certificates, not just your own certificate. Then confirm in Chrome and one other browser that the warning is gone.
How can I get warned before Chrome stops trusting my certificate?
Monitor your certificate from outside your infrastructure against the trust stores browsers actually use. TLS Radar checks whether your certificate is currently trusted by Chrome and other major browsers and alerts you the moment one drops trust - before your visitors hit a full-page warning, and independent of whether your CA sends a notice.

Get the next post in your inbox

TLS monitoring tips and product updates. No spam, unsubscribe anytime.

Keep reading

strategy 9 min

NET::ERR_CERT_AUTHORITY_INVALID in Chrome and Brave: The Real Causes in 2026
troubleshooting 4 min

Fix "Your Connection Is Not Private" in Chrome
guides 2 min

What Is SSL/TLS Certificate Monitoring and Why Does It Matter?

Related guides

Comparing tools? See how TLS Radar stacks up against DigiCert and SSL.com.