How to Fix NET::ERR_CERT_AUTHORITY_INVALID Error in Chrome?
Have you encountered NET::ERR_CERT_AUTHORITY_INVALID Error while using Google Chrome?
An error that looks like:
NET::ERR_CERT_AUTHORITY_INVALID Error
There are several different reasons why you may be encountering this digital certificate error.
Perhaps, your SSL certificate was obtained from an untrustworthy certificate authority. That is why you are facing the error.
This SSL error also occurs when the cert you are using is expired or self-signed.
In order to provide security to your website visitors and protect the data on your site, it is a must to install an SSL certificate. But that doesn’t mean you can obtain any certificate on the market.
To have the best user experience and to provide uninterrupted security to your visitors and gain their trust, go for a cert from a trusted certificate authority that is also recognized by browsers.
To help you fix the Error on Google Chrome, here are tips you can follow.
Tips to fix NET::ERR_CERT_AUTHORITY_INVALID Error on Google Chrome (For Website Owners)
Check your SSL certificate
It is a worrying sign as a web owner if your site is showing NET::ERR_CERT_AUTHORITY_INVALID Error. Many visitors may leave your site and never return when they see security warnings as they are worried about their online safety.
Ensure that your SSL is not expired. To check, visit the address bar in Google Chrome and tap on the padlock icon.
In the popup box, tap on Valid under the Certificate tag.
Check the expiration date from there.
If your SSL is expired, you will have to renew it or go for a new SSL.
NET::ERR_CERT_AUTHORITY_INVALID Error also occurs when the browser does not recognize your SSL cert or if the digital certificate is self-signed. In both these cases, you will have to obtain your SSL from a trusted Certificate Authority.
Tips to fix NET::ERR_CERT_AUTHORITY_INVALID Error on Google Chrome (For Website Visitors)
Supposing you have encountered this error when you are visiting a website that is not yours, you can apply several tips to try and resolve the issue.
Correct the time and date in your PC
At times, the error may occur due to minor issues such as setting incorrect time and date in your PC. You can resolve this easily.
Just go to the Start menu in your Windows and tap on settings. In the Time and Date option, check Set time automatically and Set time zone automatically.
Restart Chrome and visit the web page that was showing the error earlier.
If it resolves the issue, well and good!
Update Google Chrome browser
To update your browser to the latest version,
At the top right, click on Menu .
Next, click on Help and navigate to About Google Chrome.
If there are any updates available, Chrome will check and immediately download them.
If the updates have already been downloaded and are waiting for installation, you will see an up arrow instead of the usual ‘Menu’ icon.
In case the color is green, the update has been available for two days. An orange up arrow indicates an update has been available for four days. If the icon is red, an update has been available for a week.
After installation, or if it has been waiting for some days, click on Relaunch.
Go back to chrome://settings/help to confirm you are running the latest version of Chrome.
The latest Chrome version for Windows is 83.0.4103.116, released on 2020-06-16.
Clear browsing data
Chances are, expired cookies and browser cache is causing the error.
One way to ascertain if the error is caused by cookies and cache is to open the site in incognito mode. Press Ctrl+Shift+n. If you can visit the site in this mode, browser cache and cookies are the culprits.
You will have to clear your browsing history in Chrome.
Open Chrome and click on the top-right icon. Choose More tools and then tap on Clear browsing data.
In the Time range, select All time. Check Browsing history, Cookies and other site data, and Cached images and files.
Click on Clear data.
Restart your system to see if the issue has been resolved.
Deactivate Google Chrome’s extensions
Your browser extensions may be causing the error. Deactivate them to check if it resolves the issue.
But before that, open the website in incognito mode. If you can access the site in this mode, the problem is with your browser extension.
To deactivate:
Open Google Chrome. In the top right corner of your browser, click on the icon.
Next, tap on More tools and visit Extensions.
In a new tab, you will see a list of all the installed Chrome Extensions. You can remove the extensions one by one by clicking on Remove.
A prompt will pop up, asking if you are sure about removing the extension. Click on the remove button.
Removing the extensions might, at times, fix the issue.
Disable antivirus software
To disable antivirus software in Windows:
On the far right side of the Windows taskbar, find the antivirus protection program icon.
Right-click on the icon. Next, select Disable, Stop, shut down, or whichever prompt you get.
Note that, in some cases, you will be required to open the program to deactivate it, making use of the program’s menus.
Wrapping-Up
Hopefully, these troubleshooting tips will help you to fix the NET::ERR_CERT_AUTHORITY_INVALID Error, which you have been facing.
Remember to get an SSL certificate from a trusted Certificate Authority. Many a time, digital certificate errors occur because the browser cannot recognize the cert issued by a certificate authority that cannot be trusted.
If that does not solve the issue, follow the tips one by one provided in this article.
An SSL certificate is crucial to safeguard your data and offer security to your users and gain their trust. Do not let some issues stop you from using an SSL. Errors relating to SSL can be solved, provided you know how to troubleshoot them.
Related Articles:
- How to Fix NET::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN Error in Chrome
- Fix NET::ERR_CERT_REVOKED Error in Chrome, IE, Mac and Windows
- How to fix SSL Connection Error on Chrome?
- How to Fix “Your connection is not private” Error in Chrome?
Quick Links
- Free SSL Testing Tools
- Download Free Site Seal
- SSL Discount Offers
How To Fix the ERR_BAD_SSL_CLIENT_AUTH_CERT Error (7 Methods)
Currently, Google Chrome is the most popular desktop browser in the world. Although it has a user-friendly interface, you may still encounter some problems while using it, like the ERR_BAD_SSL_CLIENT_AUTH_CERT error message. Fortunately, fixing the ERR_BAD_SSL_CLIENT_AUTH_CERT error doesn’t require much technical experience. You may simply need to update Chrome, clear your cache, or delete conflicting browser extensions. In this post, we’ll take a closer look at the ERR_BAD_SSL_CLIENT_AUTH_CERT error and what causes it. Then, we’ll show you seven easy ways to fix it. Let’s get started!
Check Out Our Video Guide On Fixing The ERR_BAD_SSL_CLIENT_AUTH_CERT Error:
What Is the ERR_BAD_SSL_CLIENT_AUTH_CERT Error?
While trying to access a website in Chrome, you might get an ERR_BAD_SSL_CLIENT_AUTH_CERT error message. This will prevent you from accessing the page. To understand this Chrome error, you’ll need to know how SSL works. Secure Sockets Layer (SSL) is a security protocol that encrypts and authenticates any data sent from a web server to your browser. As a website owner, it’s important to secure your site with an SSL certificate. This will help you protect the content on your website, including sensitive data. There’s also the Transport Layer Security (TLS) protocol, which is an updated version of SSL that further authenticates your server. When you try to access a website, Google Chrome will check for security protocols like an installed SSL certificate. If your browser cannot provide a secure connection, it will return an ERR_BAD_SSL_CLIENT_AUTH_CERT error. Is this error ruining your browsing experience on Google Chrome? ��♀️ No problem! We’ve got 7 easy solutions to get you back up and running in no time ✅ Click to Tweet
What Causes the ERR_BAD_SSL_CLIENT_AUTH_CERT Error?
- Corrupt browser cache
- Unsynchronized time and date on a device
- Third-party software blocking the website
- Third-party SSL/TLS protocol filtering
- Outdated device or Chrome version
As you can see, different factors can trigger the ERR_BAD_SSL_CLIENT_AUTH_CERT error. While this may seem overwhelming, you can easily identify the root cause and implement an effective solution.
How To Fix the ERR_BAD_SSL_CLIENT_AUTH_CERT Error (7 Methods)
Like most Chrome issues, the ERR_BAD_SSL_CLIENT_AUTH_CERT error can prevent you from accessing a website. Let’s look at some easy ways to troubleshoot and fix this error.
1. Update Google Chrome
As we mentioned earlier, an outdated web browser can lead to an ERR_BAD_SSL_CLIENT_AUTH_CERT error message. Chrome constantly updates its software to resolve security issues and fix bugs. If you’re using an older version, it may produce more browsing errors.
To make sure your browser is updated, select the three-dot icon in the upper right corner. Then, click on Help > About Google Chrome:
Chrome will then check for new updates. If there is one available, it will automatically install it:
Once the update is finished, you’ll need to restart Google Chrome. To do this, hit the Relaunch button.
When the browser reopens, try visiting the website you were trying to access. If the ERR_BAD_SSL_CLIENT_AUTH_CERT message is still visible, you can move on to the next method.
2. Sync Your Device’s Date and Time
Sometimes, your device won’t display the correct date or time. If these two settings are out of sync, it could create conflicts with your browser.
For example, a website’s SSL certificate may have just been renewed, but if the date on your computer is wrong, the browser might recognize it as invalid. This can easily trigger an ERR_BAD_SSL_CLIENT_AUTH_CERT error.
To fix this, open your Windows Settings app. Then, navigate to Time & language and select Date & time:
Make sure to enable automatic configuration for both the time and time zone. Under Additional settings, click on the Sync now button. This will help ensure that your device displays the same date and time as Microsoft servers.
Although this is commonly a Windows issue, you can also check the date and time on a Mac. In your System Preferences, select Date & Time:
By default, the date and time will be set automatically. If this information is incorrect, deselect the Set date and time automatically setting. Then, you can set the date and time manually:
When you’re ready, save your changes. Then, check to see if the browser error has been resolved.
3. Clear Your Browser Cache and Cookies
If none of the previous methods resolved the ERR_BAD_SSL_CLIENT_AUTH_CERT error, the issue may be with your cached data. When you visit a website for the first time, your browser will save data in a cache. This reduces the number of HTTP requests when you revisit the site so that the page can load faster.
Unfortunately, your browser cache could become corrupted or outdated. This can cause many Chrome errors, so you may need to clear it.
To clear your browser cache, go to More Tools > Clear Browsing Data:
In the pop-up window, select Cached images and files. Feel free to also clear the browsing history, cookies, and other site data:
When you’re finished, click on Clear data. Then, refresh the page to see if it loads.
4. Delete Conflicting Browser Extensions
If you’re using browser extensions, these may negatively impact your browsing experience. If the software is old or out-of-date, it could cause the ERR_BAD_SSL_CLIENT_AUTH_CERT error.
To troubleshoot this issue, go to More Tools > Extensions in Chrome:
This will display a list of all your installed Chrome extensions. Use the toggle buttons to turn off every tool:
Now that all your extensions have been disabled, try to access the website that displayed the ERR_BAD_SSL_CLIENT_AUTH_CERT message. If it loads, then one of your extensions was triggering the error.
To identify the culprit, go back to your Extensions page and reactivate each extension one at a time. After each reactivation, check to see if the error reappears. Once it does, you can remove that specific extension.
5. Update Your Device
Another simple solution is to update your operating system. Outdated Windows versions have been known to trigger the ERR_BAD_SSL_CLIENT_AUTH_CERT error.
Start by navigating to your Windows Settings. Then, select Windows Update. Here, you can check for new updates and install them if available:
To update a Mac computer, open your System Preferences. Then, find the Software Update option:
If there is a new update, you can hit Upgrade Now. To prevent any future issues, consider checking the box next to Automatically keep my Mac up to date:
Once you update your computer, open Chrome and revisit the website that caused the error. If you don’t see the error message, you can continue browsing normally!
6. Disable QUIC Protocol
QUIC (Quick UDP Internet Connection) is an experimental protocol that was created to improve HTTP traffic. Similar to TLS and SSL, it aims to create secure connections with reduced latency.
Although Chrome uses QUIC protocol, it is still an experimental setting. As a result, it could cause loading errors.
If you haven’t found a solution to the ERR_BAD_SSL_CLIENT_AUTH_CERT error, try disabling the QUIC protocol. First, search for “chrome://flags/#enable-quic” in your browser:
Using the dropdown menu on the right, disable the Experimental QUIC protocol setting:
Once you implement this change, you’ll need to relaunch Chrome.
7. Temporarily Turn Off Anti-Virus Software
You may have third-party applications that perform SSL/TLS protocol filtering. For example, anti-virus software and firewalls will often scan websites for SSL certificates. Although this can boost your security, it can also cause the ERR_BAD_SSL_CLIENT_AUTH_CERT error.
Programs like Nod32, Avira, and McAfee commonly identify false positives when scanning websites. Although every software is different, you should be able to disable settings related to SSL/TLS protocol.
Alternatively, you can temporarily disable the entire anti-virus software. You may also need to turn off firewalls, Virtual Private Networks (VPNs), and any other security software on your device.
Just like with your browser extensions, check to see if the error disappears after you deactivate each program. This can help you target the source of the issue.
Summary
An ERR_BAD_SSL_CLIENT_AUTH_CERT error crops up when Chrome is unable to verify a website’s SSL certificate. As a result, Chrome will block the target resource to protect the user. However, some factors, like outdated software, may cause the browser to falsely identify an SSL certificate as invalid.
To resolve the issue, you may need to update your device, reset the date and time, and clear the browser cache. You might also want to try disabling the QUIC protocol, your browser extensions, and any anti-virus software on your device.
As a website owner, you’ll want online visitors to safely access your content. With any Kinsta hosting plan, you’ll receive a free SSL certificate. Plus, we provide 24/7 customer support so you can talk with an expert about any technical issues!
Get all your applications, databases, and WordPress sites online and under one roof. Our feature-packed, high-performance cloud platform includes:
- Easy setup and management in the MyKinsta dashboard
- 24/7 expert support
- The best Google Cloud Platform hardware and network, powered by Kubernetes for maximum scalability
- An enterprise-level Cloudflare integration for speed and security
- Global audience reach with up to 35 data centers and 260 PoPs worldwide
Get started with a free trial of our Application Hosting or Database Hosting. Explore our plans or talk to sales to find your best fit.
Is your WordPress site slow?
Uncover your website’s performance bottlenecks to deliver a better user experience.
Error: «SSL Error 61: You have not chosen to trust ‘Certificate Authority’. » on Receiver for Windows
Citrix Workspace app is the new universal app for all workspace services, that will encompass all Citrix clients and app capabilities over time.
The following error messages are displayed for Receiver users accessing StoreFront or Web Interface applications:
- «Cannot connect to the Citrix XenApp Server. SSL Error 61: You have not chosen to trust «Certificate Authority», the issuer to the server’s security certificate.»
- «The server certificate received is not trusted (SSL Error 61)»
- «Your app is not available. Try again later.»
Solution
Important! This article is intended for use by System Administrators. If you are experiencing this issue and you are not a System Administrator, contact your organization’s Help Desk for assistance and refer them to this article.
Update to the Latest Receiver Version
- Upgrade to the latest version of Receiver to verify if this resolves the issue.
- If you are using SHA2 certificates then the older version of Receiver does not support these certificate. Refer to CTX200114 — Citrix Receiver Support for SHA-2 to view the Receiver versions which supports SHA-2 certificates.
If this does not resolve the issue then proceed to the next section.
For information on Receiver feature updates refer to — Citrix Receiver Feature Matrix.
Missing Root/Intermediate Certificate
This error message suggests that the client device does not have the required root certificate/intermediate certificate to establish trust with the certificate authority who issued the NetScaler Gateway server certificate.
- Download or obtain the SSL root certificate/intermediate certificate (.crt/.cer) file issued by your SSL certificate provider.
Root certificate/intermediate certificate can be downloaded from your SSL certificate provider’s website or can be obtained on request. Usually root certificate is present in the certificate bundle provided by your SSL service provider along with intermediate and server certificates. - Install the root certificate/intermediate certificate on the client machine.
- If an antivirus is installed on the client machine then ensure that the antivirus trusts the certificate.
This process pairs your client machines with the server machine, and is necessary if you do not use a certificate verified by a commercial SSL certificate provider. Most commercial certificate providers arrange to have their certificates pre-installed on machines through an agreement with the operating system creator (Microsoft, Apple, and so on).
Server Certificate is Not RFC 3280 Compliant
SSL Error 61 can occur when the server certificate is not compliant with the instructions in RFC 3280 regarding the Enhanced Key Usage field.
The system administrator might need to contact the certificate authority who sold the faulty certificate and inform them that the certificate is in violation of RFC 3280. Also ask the certificate authority to issue a new certificate that contains the following key usage value in addition to any other required values:
Server Authentication (1.3.6.1.5.5.7.3.1)
NetScaler Gateway acts as an SSL server, so Server Authentication (1.3.6.1.5.5.7.3.1) must be listed among the designated key uses if any are present. If the Extended Key Usage field is not present in the certificate, the certificate might be considered valid.
Some certificate authorities erroneously issue certificates that contain only the following key usage extensions that indicate support for Server-Gated Cryptography (SGC):
- Unknown Key Usage (2.16.840.1.113730.4.1)
- Unknown Key Usage (1.3.6.1.4.1.311.10.3.3)
These extensions are intended as a signal to Netscape and Internet Explorer web browsers that they should negotiate 128-bit encryption regardless of the normal capabilities of the client. They have no effect on the ICA client. When these two values are the only items listed in the Enhanced Key Usage field, the certificate is in violation of RFC 3280 and should be rejected by SSL clients seeking server authentication.
Note: Not all SGC compliant certificates are missing the Server Authentication value and not all invalid certificates are SGC compliant.
After you receive an updated certificate with the correct usage fields listed, replace the certificate on your NetScaler Gateway server using the MMC Certificates snap-in.
Additional Resources
- Microsoft TechNet — Configure Trusted Roots and Disallowed Certificates
- Microsoft TechNet — Error Message: This Security Certificate Was Issued by a Company that You Have Not Chosen to Trust
- Installing the Root & Intermediate Certificates
- CTX128539 — How to Link an Intermediate Certificate to the Server Certificate in NetScaler/NetScaler Gateway
- CTX200836 — Error: «SSL Error 61: You have not chosen to trust ‘Certificate Authority’. » When Launching Apps with Citrix Online Plug-in
- CTX203362 — Error: «The server certificate received is not trusted (SSL Error 61)» on Receiver for Linux
- CTX108800 — Error: «SSL Error 61: You have not chosen to trust ‘Certificate Authority’. » on Receiver for Mac
Citrix Discussions — SSL Error 61
Disclaimer
Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.
Fix ERR BAD SSL CLIENT AUTH CERT error for Google Chrome
Google Chrome web browser checks the SSL Security Certificate of the web page that the user is trying to access. If it is unable to, then one error related to SSL Certificates which a user may face while browsing with Chrome is ERR BAD SSL CLIENT AUTH CERT. This can be caused due to many factors like the computer’s Time and Date is out of sync, Cached Data is corrupt, third-party software installed on the computer is blocking the site, etc.
ERR_BAD_SSL_CLIENT_AUTH_CERT error
- Update Google Chrome.
- Sync Date and Time.
- Clearing browser data.
- Checking and fixing any third-party software conflicts.
- Change TLS/SSL3 and QUIC settings.
1] Update Google Chrome
You can try to get the latest version of Google Chrome and have it installed on your computer and check if that fixes your issue.
2] Sync Date and Time
Wrong Date and Time settings on Windows 10 can also cause conflicts like this. It* is due to the incompatibility between the SSL Certificate validation date and the System Clock. Hence, the user should sync their System Clock.
To do this, start by right-clicking on the Taskbar and click on Adjust Date and Time.
Click on a button that says Sync Now. It will synchronize the Date and Time with the Microsoft Servers.
All you need to make sure is that the Time Zone setting on the same page is correct.
3] Clear browser data
There are high chances that some browser data is conflicting with the loading of the website. It might be a very basic fix, but in this case, it can be proved a highly reliable one.
For this, start by opening Google Chrome. Now hit the CTRL + H button combination on your keyboard.
It will open a new panel to delete your browsing history and other data. Select every checkbox that you see and finally click on Clear browsing data.
Restart your browser and check if your error is fixed or not.
4] Check and fix any third-party software conflicts
Third-party internet protection software like Antivirus can also be a cause for this error. Due to some reason, they might be detecting the web page to be malicious or with less credibility. And hence, this might be blocking the web page on your web browser. So, to fix that, I would suggest you see if any third-party software like VPN, Security software, or an add-on may be interfering and turn it off. You could open your antivirus software and temporarily disable web protection and see if that helps.
5] Change TLS/SSL3 and QUIC settings
As a temporary measure, you may try disabling TLS1.1 & TLS1.2 and enabling SSL2 & SSL3 and see if that helps.
Follow the protocol fixes for SSL3/TLS and QUIC, which are some of the reasons to cause the error. If your antivirus or security software offers this setting, you may disable “SSL/TLS” protocol filtering and see.
How do I import client certificates to Chrome?
Open Chrome, and then click on Menu and then Settings. Go to Privacy, and then Security. Then click on Manage Certificates. It will open the certificates window. Click on the import button, and add certificates.
Why does it say this site can’t provide a secure connection?
If the site cannot offer an SSL certificate, its certificate has expired or doesn’t offer an SSL certificate for HTTPS-Complaint. While you cannot do much here, the browser provides the option to access it by accepting the risk. So make sure you only do it with a website you trust enough, even though it’s not recommended.
Are these fixes effective?