SSL Certificate Error Fix

If your visitors suddenly see security warnings, a missing or expired SSL certificate is not the only cause. Sometimes the problem is mixed content, so first you need to figure out which kind of error you are facing. The fix depends entirely on pinpointing the specific problem.

Certificate error or mixed content?

A full-page warning such as Chrome's "Your connection is not private" means the browser rejected the certificate itself, and visitors are stopped before the page loads. The error code under the warning tells you why:

• NET::ERR_CERT_COMMON_NAME_INVALID: the certificate does not match the host name in the address bar. On a blog this usually means the certificate covers example.com but not www.example.com (or the reverse), or the server is sending a certificate for a different site.
• NET::ERR_CERT_DATE_INVALID: by the visitor's clock, the certificate has expired or is not yet valid. If only one visitor sees it, their device clock may be wrong.
• NET::ERR_CERT_AUTHORITY_INVALID: the certificate is signed by an authority the browser does not trust, for example a self-signed certificate.

Mixed content is a different problem. It occurs when a page loaded over HTTPS includes resources fetched over plain HTTP. According to MDN, browsers automatically upgrade some of these requests, such as images, audio and video, to HTTPS, while scripts, stylesheets, iframes and web fonts loaded over HTTP are blocked. The page still opens, but parts of it may break, and the address bar may no longer show the page as fully secure.

Fixing certificate problems

For a name mismatch, make sure the certificate covers every host name visitors use, typically both the bare domain and www, and that one version redirects to the other. For an expired certificate, renew it. Let's Encrypt certificates are short-lived by design, and Let's Encrypt has announced it will shorten them further, so renewal has to be automatic. With Certbot, the command is certbot renew; most installations already run it on a schedule through cron or a systemd timer, and you can test it with:

sudo certbot renew --dry-run
systemctl list-timers

If renewals fail, check that the domain still points to the server and that the validation method Certbot used originally still works.

On Blogger with a custom domain, Blogger creates and renews the certificate itself. The HTTPS availability and HTTPS redirect settings live in the blog's Settings, and menu names can change over time. If the certificate does not appear, check that the www CNAME points to ghs.google.com and that the naked domain has Blogger's four A records. Blogger also warns that if you use CAA records on the domain, you must add one for letsencrypt.org, or it won't create or renew your SSL certificate.

Fixing mixed content

Renewing a certificate does not fix mixed content. The fix is to make every resource on the page load over HTTPS. Open the browser's developer console to see which URLs are flagged, then change http:// links in the theme, widgets and posts to https:// or to relative links; old image URLs often linger in templates and databases. As a safety net, the Content-Security-Policy: upgrade-insecure-requests header tells browsers to request those resources over HTTPS, but the resources must actually be available that way.

The first step is always the split: a full-page certificate warning points to the certificate, its names or its expiry date, while a page that loads with broken parts points to mixed content.