Browsers & Accounts · HTTPS & Certificates · Lesson 2 of 5

Certificate Warnings

Understand the warning page, its common causes, and the safe choice.

When the browser stops you

Sometimes your browser shows a full warning page instead of the site you wanted.

• Chrome and Edge say Your connection isn't private (Chrome words it "is not private").
• Firefox says Warning: Potential Security Risk Ahead.
• Safari says This Connection Is Not Private.

A certificate warning means the browser checked the site's certificate and something didn't match. It stopped before sending anything, to protect you.

Under the message is a short code. It looks strange, but it hints at the cause. Common ones:

• Wrong name. The certificate is for a different address. In Chrome the code is NET::ERR_CERT_COMMON_NAME_INVALID. This can mean a look-alike site, or someone sitting in the middle of your connection.
• Expired. The certificate's dates have passed, usually because the site forgot to renew it.
• Wrong clock. If your computer's date is wrong, good certificates look expired or not ready yet. Chrome may say "Your clock is behind" or "Your clock is ahead." Both this and an expired certificate show NET::ERR_CERT_DATE_INVALID.
• Untrusted issuer. No authority your computer trusts gave out the certificate. Chrome shows NET::ERR_CERT_AUTHORITY_INVALID.

Some causes are harmless mistakes. Others are attacks. From the warning page alone, you usually can't tell which. That's the key point.

So the safe choice is always the same. Click the button that takes you away, such as Back to safety or Go back.

If the warning appears on almost every site, the problem is probably on your computer. Fix the date first:

• On Windows, open Settings, then Time & language, then Date & time, and turn on Set time automatically.
• On a Mac, open System Settings, then General, then Date & Time.

Never click through on money or logins

Most warning pages hide a small button called Advanced. Behind it is a link like Proceed to the site (unsafe) or Continue. Using it is called clicking through.

Clicking through tells the browser to ignore the problem and connect anyway.

Why is that risky? A man-in-the-middle attack is when someone secretly sits between you and a website, reading or changing what passes through. They might do it on public Wi-Fi. A wrong certificate is one of the few signs you get. If you click through, they can read everything you type.

So here is a firm rule: never click through on a bank, shopping or sign-in page. Anywhere you would type a password or card number, a warning means stop.

Is a warning ever less risky? An expired certificate on a small hobby site you only read is usually a careless owner. Even then, don't type anything into it.

Sometimes the browser won't let you click through at all. Some sites tell browsers to always demand a valid certificate. This is called HSTS. When it applies, Chrome says you can't visit the site right now. That's protection working, not a broken browser.

What to do instead:

1. Choose Back to safety.
2. Check your computer's date and time.
3. On public Wi-Fi, switch to your phone's mobile data, or wait until you're home.
4. Type the site's address yourself, or use its official app.
5. Still stuck? Call the company using the number on your card or statement.

A warning costs you a few minutes. Clicking through on the wrong day could cost you your account.