How to Troubleshoot SSL Certificate Errors

Start with the exact hostname

SSL certificates are matched against the hostname in the browser address bar. A certificate that works for example.com may not work for www.example.com, app.example.com, or an older staging hostname unless those names are included in the certificate subject alternative names.

Common causes

• Expired certificate: the valid-until date has passed or the server is presenting an old certificate.
• Name mismatch: the certificate does not include the hostname users are visiting.
• Incomplete chain: the server does not provide the intermediate certificate needed by some clients.
• Wrong virtual host: the server returns a default certificate because SNI or hosting configuration is wrong.
• CDN edge delay: a newly issued certificate has not reached every edge location yet.

What to check first

Check the issuer, subject alternative names, valid-from date, valid-until date, and whether the chain is trusted. If only some users see the problem, compare locations, devices, and networks. A corporate proxy, mobile carrier, or regional CDN edge can change the certificate path.

When to escalate

If the certificate is correct but browsers still warn, ask your host or CDN provider to verify the server-side chain and SNI configuration. Include the hostname, time of the test, and a screenshot or copied certificate details without sharing private keys.

Run a quick check with the SSL Certificate Checker, then compare with your hosting or CDN dashboard before changing production settings.