NET::ERR_CERT_AUTHORITY_INVALID, what it means and how to fix it
Browsers trust certificates signed by recognized certificate authorities, whose keys ship in the browser and operating system trust stores. This error means the signature chain ends at an authority that is not in the store: the site signed its own certificate, an employer or antivirus is intercepting the connection with its own authority, or something less friendly is doing the same.
The fix, in order
- View the certificate and read the issuer. The issuer field tells you who signed. A known public authority suggests a chain problem; the site's own name means self-signed; your employer or antivirus vendor's name means local interception software is re-signing traffic.
- On a work device, ask IT before changing anything. Companies install their own authority so their security proxy can inspect traffic. If the authority was not pushed to your device correctly, IT fixes it by deploying the company CA; the error is a symptom of incomplete setup.
- Check your antivirus's HTTPS scanning. Suites that scan encrypted traffic install their own authority. If it half-installed, every site fails this way; updating or reinstalling the suite, or turning its HTTPS scanning off in its settings, resolves it.
- Update the operating system and browser. Trust stores are updated with the OS. An old, unpatched system may lack current root authorities and fail on correctly issued certificates.
- On your own development server, this is expected until you act. Self-signed certificates always trigger it. Use a real certificate (free authorities exist) for anything public; for local development only, trust your local CA on your own machines.
On a public site, over a network you do not control, this error means do not proceed. An untrusted authority is precisely how interception works: whoever controls that authority can read the “encrypted” traffic. If the issuer is a name you do not recognize and you are not on a managed work device, change networks and try again.
If it still happens
If every HTTPS site fails with this error on one machine, something local is re-signing all traffic: a security suite, a corporate agent, or malware. The certificate issuer name, checked on two different sites, will be identical and will name the culprit.
Common questions
What is a certificate authority? An organization that verifies a site's identity and signs its certificate. Browsers ship a list of authorities they trust. A certificate signed by anyone outside that list, however legitimate their reasons, cannot be verified automatically, which is what this error reports.
My company's sites show this on my personal laptop. Why? Internal company sites often use the company's own authority, which is only installed on managed devices. Your personal laptop lacks it, so the signature is unverifiable there. That is the trust system working as designed; use a managed device or the company's VPN and portal.
Related errors