Common SSL Certificate Problems Explained

Written by Constan van Suchtelen van de Haere

Last updated:

Common SSL Certificate Problems Explained

Introduction

SSL/TLS certificates are essential for securing websites, APIs, applications, and internal services. However, even when certificates are correctly issued, deployment and configuration mistakes can lead to browser warnings, service outages, failed integrations, and compliance issues.

This guide explains the most common SSL certificate problems, how to identify them, and how to resolve them.

Why SSL Certificate Problems Matter

When SSL certificates are misconfigured or expired, users and systems may experience:

• Browser security warnings
• Failed HTTPS connections
• API communication failures
• Email delivery issues
• Service downtime
• Compliance violations

Many SSL-related incidents are preventable through proper certificate lifecycle management and monitoring.

1. Expired SSL Certificates

Problem

The certificate’s validity period has ended.

Browsers may display messages such as:

Your connection is not private
NET::ERR_CERT_DATE_INVALID
Certificate has expired

Common Causes

• No renewal process in place
• Renewal reminder emails missed
• Automated renewal failures
• Certificates deployed manually

Verification

openssl x509 -in certificate.crt -noout -dates

Example output:

notBefore=May 1 00:00:00 2026 GMT
notAfter=Jul 30 23:59:59 2026 GMT

Solution

• Implement automated certificate renewal.
• Monitor certificate expiration dates.
• Configure alerts 30, 14, and 7 days before expiration.
• Use centralized certificate inventory management.

Screenshot Placeholder

Screenshot: Browser warning showing an expired SSL certificate.

2. Certificate Name Mismatch

Problem

The domain name does not match the certificate’s Common Name (CN) or Subject Alternative Name (SAN).

Example:

Certificate issued for:

www.example.com

Website accessed via:

api.example.com

Browser Error

NET::ERR_CERT_COMMON_NAME_INVALID

Verification

openssl x509 -in certificate.crt -text -noout

Look for:

X509v3 Subject Alternative Name:
DNS:www.example.com

Solution

• Request a certificate containing all required domains.
• Use SAN certificates when multiple hostnames are needed.
• Verify DNS names before generating a CSR.

Screenshot Placeholder

Screenshot: Browser displaying a Common Name mismatch warning.

3. Missing Intermediate Certificates

Problem

The server presents only the leaf certificate and omits the intermediate CA certificates.

Symptoms

• Works on some devices but not others.
• Browser trust warnings.
• SSL testing tools report an incomplete chain.

Verification

openssl s_client -connect example.com:443 -showcerts

Example Chain

Server Certificate
Intermediate CA
Root CA

Solution

Configure the full certificate chain:

SSLCertificateFile /etc/ssl/certs/server.crt
SSLCertificateKeyFile /etc/ssl/private/server.key
SSLCertificateChainFile /etc/ssl/certs/intermediate.crt

Screenshot Placeholder

Screenshot: SSL checker reporting an incomplete certificate chain.

4. Self-Signed Certificate Warnings

Problem

A self-signed certificate is used in environments where clients expect a publicly trusted certificate.

Browser Error

NET::ERR_CERT_AUTHORITY_INVALID

Causes

• Development certificates deployed in production.
• Internal PKI not trusted by client devices.
• Testing certificates accidentally left active.

Solution

For public-facing systems:

• Use a certificate from a trusted public CA.

For internal environments:

• Deploy the internal root CA to all trusted devices.
• Manage trust stores centrally.

Screenshot Placeholder

Screenshot: Browser warning for an untrusted certificate authority.

5. Weak Cryptographic Algorithms

Problem

The certificate uses outdated algorithms or insufficient key lengths.

Examples:

SHA-1
RSA 1024-bit

Risks

• Reduced security.
• Browser compatibility issues.
• Regulatory compliance failures.

Verification

openssl x509 -in certificate.crt -text -noout

Look for:

Signature Algorithm: sha1WithRSAEncryption

Solution

Use modern standards:

6. Revoked Certificates

Problem

The certificate has been revoked before expiration.

Reasons may include:

• Private key compromise
• Incorrect certificate issuance
• Employee departure
• Security incident

Symptoms

Users receive trust warnings even though the certificate is not expired.

Verification

Check:

• OCSP responses
• Certificate Revocation Lists (CRLs)

Example:

openssl ocsp \
-url http://ocsp.exampleca.com \
-cert certificate.crt \
-issuer issuer.crt

Solution

• Generate a new key pair.
• Issue a replacement certificate.
• Investigate the reason for revocation.

7. Incorrect Certificate Installation

Problem

The certificate and private key do not match.

Verification

Compare certificate and key modulus:

openssl x509 -noout -modulus -in certificate.crt | openssl md5
openssl rsa -noout -modulus -in private.key | openssl md5

Both hashes must match.

Solution

• Locate the correct private key.
• Reissue the certificate if the key is lost.
• Store keys securely using documented procedures.

8. TLS Protocol Version Problems

Problem

The server supports only outdated protocols.

Examples:

SSLv3
TLS 1.0
TLS 1.1

Symptoms

Modern browsers refuse to connect.

Verification

openssl s_client -connect example.com:443 -tls1

Solution

Enable:

TLS 1.2
TLS 1.3

Disable:

SSLv2
SSLv3
TLS 1.0
TLS 1.1

Apache example:

SSLProtocol -all +TLSv1.2 +TLSv1.3

9. Subject Alternative Name (SAN) Issues

Problem

Required hostnames are missing from the certificate SAN list.

Modern browsers ignore the Common Name and rely on SAN entries.

Verification

openssl x509 -text -noout -in certificate.crt

Example:

X509v3 Subject Alternative Name:
DNS:www.example.com
DNS:api.example.com

Solution

Ensure all required domains are included when generating the CSR.

10. Certificate Renewal Failures

Problem

Automation exists but renewal does not complete successfully.

Common Causes

• DNS validation failures
• Firewall restrictions
• Expired automation credentials
• ACME client misconfiguration

Example Log

Renewal failed:
DNS challenge validation unsuccessful

Solution

• Test renewals regularly.
• Monitor ACME client logs.
• Implement alerting on renewal failures.
• Validate DNS and network connectivity.

Screenshot Placeholder

Screenshot: Certificate management dashboard showing renewal failure alerts.

Recommended Monitoring Checks

Organizations should continuously monitor:

Best Practices

• Maintain a complete certificate inventory.
• Automate renewals whenever possible.
• Monitor all public and internal certificates.
• Standardize certificate deployment procedures.
• Use strong cryptographic algorithms.
• Regularly test certificate chains.
• Document ownership of every certificate.
• Implement certificate lifecycle management processes.

Conclusion

Most SSL certificate incidents stem from a small set of recurring issues: expired certificates, incomplete chains, hostname mismatches, weak cryptography, and failed renewals. By implementing proactive monitoring, automation, and centralized certificate management, organizations can significantly reduce the risk of outages and security warnings.

For DevOps teams, SREs, municipalities, and enterprise IT departments, certificate visibility and lifecycle management are critical components of maintaining secure and reliable digital services.