What Chrome actually shows you
The heading is the same for every certificate problem. Underneath it, Chrome shows this paragraph:
Attackers might be trying to steal your information from <SITE>
(for example, passwords, messages, or credit cards).The button is "Back to safety". Below that there is an "Advanced" link, which expands to show the error code and, on some errors, a "Proceed to <SITE> (unsafe)" link.
The warning is generic. The code is not.
This is the single most useful thing to understand about this page.
Chrome uses the same alarming heading and the same paragraph about attackers for every certificate problem, whether the site is genuinely dangerous or someone simply forgot to renew a certificate. The heading tells you almost nothing.
The code does. Click Advanced and look for a line beginning NET::ERR_CERT_. That is the real diagnosis.
- →NET::ERR_CERT_DATE_INVALID The certificate is outside its valid dates. Very often it is your device clock that is wrong, not the certificate.
- →NET::ERR_CERT_AUTHORITY_INVALID The certificate does not chain up to an authority the browser trusts. Usually a missing intermediate certificate.
- →NET::ERR_CERT_COMMON_NAME_INVALID The certificate is real, but it does not cover the exact address you typed.
- →NET::ERR_CERT_REVOKED The authority that issued the certificate cancelled it. Take this one seriously.
Sometimes Chrome blames your clock instead
If Chrome thinks your device has the wrong date, it does not show "Your connection is not private" at all. It shows a different heading:
Your clock is ahead
Your clock is behindBoth of these appear in place of the usual heading on a date related certificate error. If you see either one, fix your device date and time and reload. Nothing is wrong with the site.
Sometimes there is no way through, and that is deliberate
On most certificate errors, expanding Advanced gives you a "Proceed to <SITE> (unsafe)" link. On some, that link is removed entirely and Chrome tells you plainly that you cannot continue. The three cases look like this:
You cannot visit <SITE> right now because the website uses certificate pinning.
You cannot visit <SITE> right now because the website uses HSTS.
You cannot visit <SITE> right now because its certificate has been revoked.HSTS and certificate pinning are protections the site itself switched on. Revocation is the certificate authority cancelling the certificate. In all three cases there is no override, by design.
When continuing anyway is a bad idea
Expired, self-signed, unknown authority and wrong name errors can all be clicked through. That does not make it a good idea.
Clicking through means you accept an unverified connection. Anything you send after that could be read or altered by whoever is actually on the other end, and you have no way to know who that is.
Our rule is simple. If you would type anything into the site, a password, a card, an address, a message, do not proceed. If it is a router admin page on your own network or a test server you built yourself, it is a different situation.
Read more about what a valid certificate proves in our guides to SSL certificates and HTTPS.
How to find out what is really wrong
You do not have to open a risky site to diagnose it. The checker at the top of this page runs our certificate check against any address and reports the precise reason in plain English, such as the certificate has expired, is not issued by a trusted authority, or does not match this website address.
That maps directly onto the Chrome codes above, so you can tell within seconds whether you are looking at a forgotten renewal or something worth worrying about.
Frequently asked questions
Does this warning mean the site is hacked?
Usually not. The most common causes are an expired certificate, a certificate that does not cover the exact address, or a missing intermediate certificate. All of those are configuration mistakes. Chrome uses the same alarming wording for all of them because it cannot tell a mistake from an attack, so it warns you about the worst case.
Why do I get it on every site I visit?
If it happens everywhere, the problem is almost certainly on your side. The usual causes are a wrong device date and time, an antivirus product that inspects encrypted traffic, or a corporate network that intercepts connections. Check your clock first, then try the same site on mobile data or a different device.
Is it safe to click "Proceed to <SITE> (unsafe)"?
The option exists, but treat it as a last resort. Once you proceed, the connection is not verified, so anything you send could be read or changed in transit. Never proceed on a site where you would enter a password or payment details. It is only reasonable on something like your own equipment where you already know why the certificate is not trusted.
Why does Chrome sometimes refuse to let me continue at all?
Three situations remove the option. Certificate pinning and HSTS are protections the site owner turned on, and revocation means the certificate authority cancelled the certificate. Chrome states this directly, for example "You cannot visit <SITE> right now because its certificate has been revoked." There is no override and there is no setting to bring one back.
It is my site. How quickly should I fix it?
Immediately. Visitors see a full page red warning before any of your content loads, and most of them will leave rather than click through. Run a check to get the exact reason, then renew the certificate, install the full chain, or reissue it to cover the right hostnames depending on which code Chrome is showing.