When the browser shows “Not secure” or a full-page warning such as “Your connection is not private” on your website, something is wrong with the SSL certificate or with how the page is loaded. This article lists the usual causes and what you can do about each one.
What the browser shows
- Full-page warning – for example “Your connection is not private” (Chrome, Edge) or “Warning: Potential Security Risk Ahead” (Firefox). The browser doesn't trust the certificate at all: it is missing, expired, or made out for another name.
- “Not secure” next to the address – the page opened with
http://instead ofhttps://, or a secure page loads some images or scripts overhttp://.
Click the symbol to the left of the address to see more details. Chrome and Edge often show a code such as NET::ERR_CERT_COMMON_NAME_INVALID or NET::ERR_CERT_DATE_INVALID on the warning page – it helps us if you put it in a ticket.
Causes and fixes
The certificate hasn't been issued yet
Your hosting gets a free certificate automatically (AutoSSL), but only after the domain points to our server. A new domain, or a domain you just moved to us, can take a while to work everywhere (see Why isn't my domain working yet? (DNS propagation)). Check the state in cPanel under SSL/TLS Status: see Free SSL certificate (AutoSSL).
The domain points somewhere else
AutoSSL can only issue a certificate if the domain's DNS leads to your hosting with us. If your domain uses the nameservers of another provider, its A record must point to your hosting. See Use a domain you have with another provider. Until that is fixed, the certificate can't be issued or renewed.
The name isn't covered
A certificate is valid only for the names listed in it, for example example.co.za and www.example.co.za. A subdomain or addon domain you just added gets its own certificate on the next AutoSSL run. SSL/TLS Status in cPanel shows which names are covered.
The certificate has expired
AutoSSL renews the free certificates by itself. If a renewal fails – usually because the domain no longer points to us – the certificate runs out and visitors see a warning. SSL/TLS Status in cPanel shows the expiry date of each certificate.
The site opens with http://
The certificate is fine, but visitors who type your address without https:// get the insecure version. Send everybody to https:// automatically: see Always open your site with https://. In WordPress, also check under Settings → General that WordPress Address (URL) and Site Address (URL) start with https://.
Mixed content: “Not secure” although https:// is used
The page itself is secure, but it loads pictures, fonts or scripts with an http:// address, often from old posts or theme settings. Change those addresses to https://. In WordPress, a plugin that rewrites old http:// links can help. Make a backup first (see Back up and restore WordPress with Softaculous).
The warning appears on every website
Then the problem is on your device, not on your site. Check that the date and time on your computer or phone are correct, and try another network or browser. Some antivirus programs and company networks also cause certificate warnings.
Still showing a warning?
Open a ticket with the full address of the page, a screenshot of the warning and the code shown on it.
Related articles
- Free SSL certificate (AutoSSL)
- Always open your site with https://
- Why isn't my domain working yet? (DNS propagation)
Need help? Open a ticket or call us on 082 412 6556.
