How to solve SSL certificate untrustworthy? Summary of SSL certificate untrustworthy solutions

when browsing the website, many users will encounter the prompt that the SSL certificate is not trusted in the browser, which will not only prevent normal access, but also may make users worry about whether the website has security risks. SSL certificates are an important certificate for website security, and their trust problems may be caused by various factors such as the certificate itself, browser settings, server configuration, etc. This article will organize practical SSL certificate untrustworthy solutions around various scenarios to help you quickly locate the problem and complete the repair, and re-access the target website safely.

First, the basic investigation class SSL certificate untrustworthy solution?

encounter SSL certificate untrustworthy prompt, you can first start from the most basic link to investigate, such problems are often the lowest cost to solve, but also the most easily ignored.

1, check the system and browser time

SSL certificate has a strict valid period limit. If the time of the device system or browser deviates too much from the actual time, for example, after the expiration time of the certificate is set in advance, or before the effective time of the certificate, the browser will determine that the certificate is not trustworthy. At this time, just enter the time setting interface of the device, turn on the automatic synchronization network time function, manually calibrate to the current exact time, and refresh the page to verify whether the problem is solved.

2, confirm whether the website domain name matches

part of the SSL certificate is bound to a specific domain name, if the user accesses the domain name does not match the domain name bound to the certificate, such as the certificate binding is the main domain name, but accesses the sub-domain name not included in the certificate range, it will trigger the untrusted prompt. At this time, carefully check whether the visited URL is correct. If you really need to access the sub-domain name, you need to confirm whether the sub-domain name is within the coverage of the certificate, or contact the website administrator to apply for an SSL certificate containing the corresponding sub-domain name.

Second, the browser side SSL certificate is not trusted solution?

browser is the core carrier for verifying SSL certificates, many SSL certificate untrustworthy problems are related to browser settings or caching, and adjustment for the browser itself is an important repair path.

1, clean browser cache and Cookie

browser will cache the certificate information of the previous visit to the website. If the website subsequently replaces the new SSL certificate, the old cache information is not timely updated, which will cause the browser to determine that the certificate is not trustworthy. Users can enter the browser's settings interface, find the privacy and security option, select Clean browsing data, tick the cache file and cookie option and perform the cleaning operation. After completion, restart the browser and try to access the website.

2, Manually import trusted SSL certificates

if you confirm that the website is safe and reliable, such as the internal office system of the enterprise, you can solve the untrustworthy problem by manually importing the certificate. First, on the certificate prompt interface of the browser, click View Certificate Details to download the certificate file to the local; then enter the privacy and security settings of the browser, find the certificate management option, select Import the downloaded certificate file, and set it as a trusted root certificate authority. After completing the settings, you can access the website normally.

Third, the server-side SSL certificate is not trusted solution?

for website administrators, if a large number of users feedback SSL certificate is not trusted, there is a high probability that there is a problem with the certificate configuration on the server side, which needs to be investigated and repaired from the server level.

1, check whether the SSL certificate is expired or not valid

administrator can log in to the background of the certificate authority to check the valid period of the currently used SSL certificate, and confirm whether the certificate has expired or has not yet reached the effective time. If the certificate has expired, you need to apply for renewal or repurchase a new SSL certificate in time; if the certificate is not valid, you need to wait for the authority to complete the review and effective process, or check whether the certificate activation step is missing.

2 Verify that the certificate chain is fully configured

SSL certificates usually need to be paired with intermediate certificates to form a complete certificate chain in order to be trusted by browsers. If the server only installs the master certificate and does not configure the corresponding intermediate certificate, the browser cannot complete the complete trust chain verification, thus prompting that the certificate is not trusted. Administrators need to download the complete certificate chain file from the certificate authority, including the master certificate and the intermediate certificate, and then re-upload and configure the complete certificate chain in the server's SSL configuration interface. After the configuration is completed, restart the server to take effect.

4. Special scenario SSL certificate untrustworthy solution?

In addition to the common basic, browser, server scenarios, there are some special environments where SSL certificates are not trusted, which need to be dealt with in a targeted manner.

1, resolve trust issues caused by proxies or VPNs

when using a proxy server or VPN to access a website, the proxy device may replace the SSL certificate of the website, causing the certificate recognized by the browser to not match the actual website certificate, triggering an untrusted prompt. At this time, you can try to close the proxy or VPN and directly use the network to access the website. If you can access it normally, it means that it is the certificate problem of the proxy device. You can contact the proxy service provider to obtain the corresponding trust certificate, or replace other compliant proxy services.

2, dealing with enterprise security software interception issues

some enterprises will deploy end point security management software, such software may scan and verify the SSL certificate of the website. If the certificate library of the software is not timely updated, it will misjudge some legitimate certificates as untrustworthy. At this time, you can contact the IT administrator of the enterprise, add the target website to the trust list of the security software, or update the certificate trust library of the security software by the administrator, so as to solve the problem of the certificate being intercepted.

sum up, the SSL certificate untrustworthy problem incentives cover multiple links, from the basic time setting, domain name check, to browser cache cleaning, certificate manual import, and then to the server certificate chain configuration, special environment adaptation, the corresponding SSL certificate untrustworthy solutions also have their own emphasis. Users can gradually check in the order from easy to difficult, and website administrators need to focus on the validity and configuration integrity of the certificate on the server side, so that they can efficiently solve the certificate trust problem and ensure the security and smoothness of website access.