Question 1

Why is my SSL certificate not working?

Accepted Answer

An SSL certificate stops working when it has expired, does not match the domain, is missing intermediate certificates in its chain, or is self-signed and therefore untrusted. Any of these causes browsers to reject the connection. The diagnosis above checks each of these conditions on your live certificate.

Question 2

How to diagnose SSL certificate problems?

Accepted Answer

Connect to the server on port 443 and inspect the certificate it presents: check that it is valid and trusted, that it has not expired, that its common name or SAN covers the domain, that the intermediate chain is complete, and that the server negotiates TLS 1.2 or higher. The tool above performs all five checks in seconds.

Question 3

What causes SSL certificate errors in browsers?

Accepted Answer

The common causes are an expired certificate, a name mismatch between the certificate and the domain, an incomplete or missing intermediate chain, a self-signed certificate, or an outdated TLS version. Each produces a distinct browser warning, and identifying which one you have determines the fix.

Question 4

How to fix an expired SSL certificate?

Accepted Answer

Issue a new certificate and install it on the server, then reload the web server so it serves the new certificate. To prevent recurrence, automate renewal — for example with certbot and a cron job or systemd timer — so certificates renew well before their expiry date.

Question 5

What is a certificate chain error?

Accepted Answer

A certificate chain error means the server presented your certificate but not the intermediate certificate(s) that link it to a trusted root. Browsers cannot build a path to a trusted authority, so they reject it. The fix is to install the full chain (your certificate plus the provider’s intermediates) on the server.

Question 6

Why does my browser show SSL security warning?

Accepted Answer

Browsers show a security warning when the certificate cannot be trusted for the site — typically because it has expired, the hostname does not match, it is self-signed, or the chain is incomplete. The warning protects users from connecting insecurely, so the underlying certificate issue must be fixed rather than bypassed.

Question 7

How to fix mixed content SSL warnings?

Accepted Answer

Mixed content warnings appear when an HTTPS page loads resources — images, scripts, or stylesheets — over plain HTTP. Fix it by updating those resource URLs to https:// (or protocol-relative //) and, where possible, adding an upgrade-insecure-requests policy so the browser upgrades them automatically.

Question 8

What TLS version should my server use?

Accepted Answer

Servers should support TLS 1.2 as a minimum and TLS 1.3 where available, and disable the deprecated TLS 1.0 and 1.1 and all SSL versions. Modern clients expect TLS 1.2+, and many compliance standards require it. The diagnosis reports which protocol version your server negotiated.

Question 9

How to renew SSL certificate automatically?

Accepted Answer

Use an ACME client such as certbot with a scheduled task. certbot renew run daily via cron or a systemd timer checks each certificate and renews any within 30 days of expiry, then reloads the web server. This removes the risk of an outage caused by a forgotten manual renewal.

Question 10

What is the difference between SSL error types?

Accepted Answer

Expiry errors mean the validity period has passed; name-mismatch errors mean the certificate does not cover the requested hostname; chain errors mean intermediates are missing; trust errors mean the issuer is not a recognised authority (as with self-signed certificates); and protocol errors mean the server offers only outdated TLS versions. Each has a different, specific fix.