'Your Connection Is Not Private': What This SSL Warning Actually Means

A full-page warning that says “Your connection is not private” is designed to stop you in your tracks — and most of the time, it should. But the warning covers a wide range of causes, from a harmless expired certificate on a site you trust, to an active attempt to intercept your traffic. Knowing which one you’re looking at changes what you should do next.

What’s actually being checked

Every HTTPS site presents an SSL/TLS certificate that proves two things: that the connection is encrypted, and that you’re really talking to the domain you think you are. Your browser verifies that certificate against a chain of trust before it loads the page. This warning means that verification failed — the browser is refusing to vouch for the connection until you decide otherwise.

The warning screen usually names the specific problem in smaller text: NET::ERR_CERT_AUTHORITY_INVALID, NET::ERR_CERT_DATE_INVALID, NET::ERR_CERT_COMMON_NAME_INVALID, or similar. That code tells you exactly which check failed.

The common, harmless causes

An expired certificate. Certificates have a fixed validity window — often 90 days to a year — and site owners occasionally miss the renewal. This is the single most common cause and is a configuration slip, not an attack.

Your device’s clock is wrong. Certificates are only valid within a date range, so if your computer’s date is off by even a day, every certificate can look invalid, even for sites with perfectly good ones. Check your system date and time first — it’s a thirty-second fix that resolves a surprising share of these warnings.

A mismatch between the domain and the certificate’s name. This happens when a certificate was issued for example.com but you’re visiting shop.example.com, or a site recently changed domains and the certificate hasn’t caught up.

A self-signed or internal certificate. Internal tools, staging environments, and local development servers often use certificates that aren’t issued by a public authority. Your browser correctly flags these as unverifiable, even though there’s no malicious intent.

The cause you should take seriously

You’re on an untrusted network — public Wi-Fi, a shared network, or behind a VPN/proxy you don’t control. This is the scenario SSL warnings exist for: someone on the same network intercepting traffic and presenting their own certificate so they can read what you send. If you’re on public Wi-Fi at a cafe or airport and suddenly see this warning on a site that normally loads fine, that’s a real signal to stop, not to click through.

How to check which one it is

Before deciding, run through this in order:

1. Check your system clock. Fix it if it’s wrong, then reload. This alone resolves a large share of these warnings.
2. Try a different network — your phone on mobile data, for instance. If the warning disappears, something on your original network (a captive portal, a proxy, or genuine interception) was the cause, not the site itself.
3. Check the site from an independent source. A server-side SSL check will tell you the certificate’s actual issuer, validity window, and days remaining until expiry — independent of your browser or network. If it reports a valid, current certificate, your local warning points to a network or clock issue, not the site. If it reports the certificate as expired or invalid too, the site owner genuinely needs to renew it.
4. Look at the certificate details yourself. Click “Not secure” or the padlock area in your address bar to see the certificate’s issuer and expiry — Chrome and Firefox both expose this without needing to click through the warning first.

When it’s safe to proceed, and when it isn’t

If you’ve confirmed the cause is a recently expired certificate on a site you already trust — your bank’s staging link, an internal company tool, a site you’ve used for years that just had a renewal hiccup — proceeding is a judgment call with low risk, since the connection is still encrypted; it’s only the verification that failed.

Don’t proceed, under any circumstances, if: you’re entering a password, payment details, or personal information; the warning appeared suddenly on public or unfamiliar Wi-Fi; or the certificate error specifically says the domain name doesn’t match (ERR_CERT_COMMON_NAME_INVALID) rather than simply being expired. Data you submit on a connection the browser couldn’t verify isn’t guaranteed to be protected, and a name mismatch is the classic signature of interception rather than a renewal slip.

If you run the site

Renew the certificate before it expires — most hosts and certificate authorities (including free ones like Let’s Encrypt) support auto-renewal, which eliminates this entire class of warning for your visitors. If you just renewed and visitors still see the old warning, have them hard-refresh; browsers cache certificate validation results briefly.

Run a free SSL check on your own domain periodically to see the issuer, validity, and exact days remaining — catching an expiry a week out is a lot less stressful than finding out from a visitor’s screenshot.