Only Android old versions?

Ensure modern roots and TLS; update device trust store or user agent.

Error fix

How to fix “NET::ERR_CERT_AUTHORITY_INVALID”

The browser does not trust the certificate chain—self-signed, wrong hostname, or missing intermediate.

Start here first. Step 1 fixes most cases—then work down the list.

Install publicly trusted certs from a major CA or fix chain bundles on the server.
Match certificate SANs to the hostname users type.
For local dev, use mkcert or trusted dev certificates instead of click-through ignores.

TLS succeeded at the protocol level but trust validation failed before showing the page.

Untrusted CA
Self-signed certs in prod, corporate MITM without imported root, or incomplete chain.
Name mismatch
Certificate issued for a different hostname or missing SAN.

Fix trust
1. Install publicly trusted certs from a major CA or fix chain bundles on the server.
2. Match certificate SANs to the hostname users type.
3. For local dev, use mkcert or trusted dev certificates instead of click-through ignores.

Works in curl -k?: That skips verification—fix the chain for real users.
Expired cert?: Renew and automate with ACME; monitor expiry alerts.
Only Android old versions?: Ensure modern roots and TLS; update device trust store or user agent.

Still stuck? Try these related fixes next.

Tweak the message and run again—we'll match an existing fix or generate a new page.

Original error message

NET::ERR_CERT_AUTHORITY_INVALID