Certificate hostname mismatch, self-signed, untrusted: what each means
Same scary warning, different root causes
When a TLS certificate is wrong, the browser throws up a full-page warning and your visitors bounce. The frustrating part is that several very different problems produce the same alarming screen. If you do not know which one you actually have, you will waste time fixing the wrong thing. Here are the three you will meet most.
Hostname mismatch
The certificate itself is perfectly valid — properly issued, in date, signed by a trusted authority. The catch is who it was issued for. A certificate is bound to specific names, and if the name in the address bar is not on the certificate, the browser refuses it.
Common causes:
- A certificate issued for
example.combut the visitor reachedwww.example.com(or the reverse), and the other name was not included. - A wildcard
*.example.comcert used on a deeper subdomain likeapi.staging.example.com, which a single wildcard does not cover. - Serving the wrong certificate from a shared host or load balancer.
The fix is to issue or configure a certificate that lists every hostname you actually serve, often via Subject Alternative Names.
Self-signed
A self-signed certificate is one you created and signed yourself, with no certificate authority involved. The encryption still works — the connection is encrypted — but the identity part is missing. Anyone can self-sign a certificate claiming to be your site, so the browser has no reason to believe it, and it warns loudly.
Self-signed certs are fine for local development and internal tools where you control both ends. On a public site they are wrong: visitors get the warning and, worse, are trained to click through it. The fix is a real certificate from a trusted authority — free ones are widely available and automatable.
Untrusted (unknown authority)
Here the certificate was signed by an authority, but one the browser does not trust. Causes:
- An internal or private certificate authority that is not in public trust stores.
- A missing intermediate certificate, so the browser cannot build the chain back to a trusted root.
- An expired or distrusted authority.
The most common real-world version is the missing intermediate: your certificate is genuine, but the server is not sending the full chain, so the browser cannot connect it to a root it trusts. The fix is to install the complete certificate chain on the server.
Why all three matter equally to visitors
The distinctions matter to you for fixing. To a visitor they are identical: a warning that says the site cannot be trusted. Some leave immediately; others click through and get used to ignoring security warnings, which is its own danger. Either outcome erodes trust in your site.
Check your certificate
These problems are easy to misdiagnose because the warning looks the same regardless of cause. An automated scan inspects your certificate and its chain and tells you precisely which issue you have — mismatch, self-signed, missing intermediate, or expiry. Scan your site and find out exactly why a certificate is failing.