What should I do if the SSL certificate is not trusted? Detailed reasons and handling methods

in the current popularity of HTTPS encryption, SSL certificates are the core foundation for ensuring the security of website data transmission and establishing user trust, but many users will encounter SSL certificate untrusted prompts when visiting websites, which will not only block normal access, but also may cause users to question the security of websites. This article will comprehensively analyze the deep reasons for the untrusted SSL certificates, and give practical solutions based on actual scenarios to help different groups quickly resolve this kind of security access crisis and restore the normal encrypted access state of websites.

What are the core reasons why SSL certificates are not trusted?

to solve the problem of untrusted SSL certificates, we must first identify the root cause of the problem, which is often related to the certificate itself, configuration or environment.

1, the certificate itself has compliance issues

SSL certificate is not trusted may be the certificate itself does not meet the specifications, such as the certificate has passed the valid period, most of the SSL certificate valid period in 1 to 2 years, after the expiration of the certificate encryption verification function is invalid, the browser will directly determine the SSL certificate is not trusted; It may also be that the certificate authority is not trusted by mainstream browsers, some niche or has not been certified by global security organizations issued certificates, will be included in the browser distrust list.

2, the certificate configuration does not match the domain name

some sites in the deployment of SSL certificates, there will be certificate binding domain name and the actual access domain does not match the situation, such as the certificate only bound to the main domain name, but used in the sub-domain access scenario, or the certificate is bound to the old domain name, the site does not update the certificate synchronization after replacing the new domain name, in this case the browser will recognize that the domain name does not match the certificate information, triggering the SSL certificate is not trusted prompts.

3, device or browser environment

the user's device or browser settings may also cause the SSL certificate is not trusted, such as the browser's security certificate trust list is modified by mistake, delete the root certificate of the regular certificate authority; or the device system time and the actual time deviation is too large, resulting in the browser determines that the certificate valid period is abnormal, and then prompts the SSL certificate is not trusted.

2, how to repair the SSL certificate is not trusted?

for website operation and maintenance personnel, the untrusted SSL certificate will directly affect the normal operation of the website and user trust, and it needs to be repaired in time from the certificate management and configuration level.

1, verify the status of the certificate and replace the compliance certificate

first log in to the management background of the certificate authority to check the valid period of the current SSL certificate and the qualification of the authority. If the certificate has expired, you need to submit the domain name verification data in time to apply for renewal; if the authority is not trusted by mainstream browsers, it is necessary to replace the certificate issued by Symantec, Let's Encrypt and other globally recognized institutions.

2, adjust the certificate domain matching configuration

if the domain name does not match the SSL certificate is not trusted, to adjust the certificate configuration according to the domain name architecture of the site, if the site contains multiple subdomains, can be replaced with a wild-card SSL certificate to achieve the binding of the main domain name and all subdomains; if the site changes the new domain name, you need to reapply for the SSL certificate corresponding to the new domain name, and complete the deployment and configuration update of the new certificate on the server.

3, check the server certificate deployment configuration

some cases, the SSL certificate is not trusted is the server configuration error caused, such as not correctly installed certificate intermediate chain file, intermediate chain is connected to the user's browser root certificate and website SSL certificate bridge, missing or installation error will cause the browser can not complete the certificate trust chain verification, then need to re-download the complete certificate package, according to the server type of guide to redeploy the certificate and intermediate chain.

How do ordinary users deal with the SSL certificate untrusted prompt?

ordinary users encounter the SSL certificate is not trusted prompt, do not blindly operate, need to combine the scene to determine the risk and take the correct way to deal with.

1, first confirm the formal website

when the browser pops up the SSL certificate is not trusted prompt, first of all to verify whether the website is the official regular website, check whether the domain name spelling errors, avoid misspelling into the phishing website, if confirmed to be a regular website, you can further troubleshoot your own device or browser problems; if you can not confirm the regularity of the website, it is recommended to close the page immediately to avoid personal information leakage.

2, adjust the browser and system settings

if you confirm that the website is still a regular SSL certificate is not trusted prompt, you can try to reset the browser's security certificate settings, restore to the default trust list; at the same time check the device system time, the system time is adjusted to the current accurate Beijing time, because the system time deviation is too large may cause the browser to misjudge the certificate valid period, after adjustment to re-visit the website to see if it returns to normal.

3. Manually import trust certificates (with caution)

if it is a custom certificate of a regular website that causes SSL certificates to be untrusted, under the premise of confirming absolute security, you can manually import the SSL certificate of the website into the trust list of the browser. For specific operations, please refer to the help center guidelines of the browser. However, this operation has certain security risks. It is not recommended to import unknown certificates at will under non-essential circumstances.

How to prevent the recurrence of untrusted SSL certificates?

solve the problem of untrusted SSL certificates, it is necessary to do daily prevention to avoid similar problems affecting website access and user experience again.

1, set the certificate valid period reminder

for the SSL certificate is not trusted SSL certificate expires, you can set valid period reminder in the background of the certificate authority, 1 to 2 months in advance to receive the renewal notification, you can also use the monitoring tool of the server to add the certificate valid period monitoring alarm to ensure that the certificate expires before the completion of renewal and redeployment.

2. Regularly check the configuration status of the certificate

website operation and maintenance personnel should regularly check the configuration status of SSL certificates, including domain name matching, intermediate chain installation status, certificate trust chain integrity, etc., with the help of online SSL detection tools, a comprehensive test can be carried out once a month, and potential configuration problems can be found and repaired in time.

3, keep the browser and system updated

for ordinary users, keep the browser and device system timely update, to ensure that the browser's certificate trust list synchronized to the latest version, to avoid the trust list due to outdated SSL certificate untrusted problems, while updating the system and browser can also fix known security bugs, improve overall access security.

To sum up, the problem of untrusted SSL certificates involves multiple levels such as the certificate itself, configuration, and user environment. Website operation and maintenance personnel need to quickly repair from certificate management and configuration verification. Ordinary users must first confirm the security of the website and then adjust their own environment. By identifying the root cause, precise repair, and daily prevention of the whole process operation, you can effectively avoid the access obstacles and security risks caused by untrusted SSL certificates, and ensure the safe and stable operation of the website.