How to Fix Common SSL Certificate Errors

When an SSL certificate has a problem, the browser shows a full-screen red warning page — and most visitors leave immediately without entering the site. SSL issues therefore hit both your credibility and your traffic directly. The good news is that each error type has a clearly identifiable cause. This guide works through the most common SSL problems case by case, with fixes and diagnostic tools.

ERR_SSL_PROTOCOL_ERROR

Cause: The browser cannot complete the SSL handshake with the server.

Fix:

• Verify the SSL certificate is correctly installed in DirectAdmin
• Clear browser cache and SSL state (Chrome: Settings → Privacy → Clear browsing data)
• Ensure the server supports TLS 1.2 or TLS 1.3
• If using Cloudflare, check SSL mode is set to Full or Full (Strict)

NET::ERR_CERT_DATE_INVALID (Expired Certificate)

Cause: The SSL certificate has expired.

Fix:

• Renew the SSL certificate through AsiaGB Billing
• For Let's Encrypt: renew via DirectAdmin → SSL Certificates → Let's Encrypt
• Enable auto-renewal to prevent this from happening again

NET::ERR_CERT_COMMON_NAME_INVALID

Cause: The certificate doesn't match the domain being accessed.

Fix:

• Confirm the certificate was issued for the correct domain
• If using www, make sure the certificate covers both yourdomain.com and www.yourdomain.com
• Note: Wildcard certificates cover *.yourdomain.com but do NOT cover the root yourdomain.com

SSL_ERROR_RX_RECORD_TOO_LONG

Cause: The server is sending an HTTP response on port 443 instead of an HTTPS response. Usually an Apache misconfiguration.

Fix: Check your Apache Virtual Host config and confirm the SSL module is enabled and the VirtualHost is listening on port 443 with SSL directives.

Incomplete Certificate Chain

SSL may work in Chrome but fail in Firefox or on mobile devices — this usually means the intermediate certificate is missing.

Test at ssllabs.com/ssltest to see the full certificate chain and identify missing intermediates. Re-install the certificate including the full chain bundle.

SSL Diagnostic Tools

• SSL Labs Test: ssllabs.com/ssltest — grades your certificate chain, protocol support, and configuration
• Why No Padlock: whynopadlock.com — detects mixed content issues
• DNS Checker: dnschecker.org — verifies DNS propagation globally

Common SSL Certificate Errors at a Glance

Before diving into each case, the table below summarises the most common SSL error messages browsers display, along with their real cause and a concise fix. When you hit a red warning page, note the exact error text shown (for example a code starting with NET::ERR_CERT_), then match it against this table first. This lets you pinpoint the right direction quickly instead of trying random fixes one by one:

If you hit an error that isn't in this table, copy the full text and search for it, because each browser names its errors differently even for the same root cause. For example, Firefox uses SEC_ERROR_UNKNOWN_ISSUER in the same situation where Chrome shows NET::ERR_CERT_AUTHORITY_INVALID — both mean the chain is incomplete.

Checking SSL with Tools (openssl s_client, SSL Labs, browser)

Accurate SSL diagnosis starts by actually "seeing" what the server sends, rather than guessing from the error text alone. The three groups of tools below cover almost every case, from the command line to visual reports:

1. openssl s_client — check directly from your machine

The openssl s_client command connects to the server and prints the full chain it receives. It's ideal for checking whether the intermediate is present without relying on any external website:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com

Look at the Certificate chain section. If it only shows your domain's leaf (depth 0) but no intermediate (depth 1), the chain is incomplete. Also watch the Verify return code line — 0 (ok) means it's good. To check expiry dates, use:

echo | openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates

2. SSL Labs — visual grade report

Open ssllabs.com/ssltest and enter your domain. It assigns a grade from A to F and clearly states whether the chain is complete, which TLS versions are supported, and whether any known vulnerabilities exist. It's perfect for confirming results after a fix, and as evidence to share with customers or your team.

3. Browser Developer Tools

Press F12 to open DevTools and go to the Security tab (Chrome) to see the certificate status and a list of insecure resources. The Console tab reports every Mixed Content item with its HTTP URL, so you can fix each one precisely.

Fixing an Incomplete Certificate Chain (intermediate / CA bundle)

An incomplete chain is one of the top reasons a site "works in Chrome but fails on mobile or Firefox," because some desktop browsers support AIA fetching to pull the intermediate themselves, while mobile devices and most server-side API libraries cannot — so they treat the certificate as untrusted. The correct fix is to make the server send the full chain in the first place.

A complete chain must be ordered from the domain's leaf certificate, followed by the CA's intermediate; you don't need to include the root (it already lives in the user's trust store). Steps to fix:

• Get the intermediate / CA bundle file from your certificate issuer (RapidSSL, GeoTrust, DigiCert usually provide it with the certificate)
• In DirectAdmin, go to SSL Certificates and paste the full CA bundle into the CA Root Certificate field
• At the Apache file level, set SSLCertificateChainFile to the bundle file, or append the intermediate after the certificate in the .crt file
• Restart the web server, then confirm with openssl s_client or SSL Labs that every layer appears

For Let's Encrypt, the issuance tool (e.g. certbot) creates a fullchain.pem that already combines leaf + intermediate. Always point your web server at fullchain.pem instead of cert.pem to avoid a broken chain.

SSL Problems with www/non-www and Subdomains

Many sites issue a certificate for yourdomain.com only, but forget that some visitors type www.yourdomain.com, causing a name mismatch on just the www version (or vice versa). Most DV certificates from leading providers automatically include both names (root + www), but you should confirm in the SAN (Subject Alternative Name) field that both are present.

Other subdomains such as shop.yourdomain.com or mail.yourdomain.com are not automatically covered by the root certificate. Your options:

• Wildcard Certificate (*.yourdomain.com) covers every single-level subdomain, but does not cover the root yourdomain.com and does not cover nested subdomains like a.b.yourdomain.com
• Multi-Domain (SAN) Certificate lists the exact domains and subdomains you want — ideal when you have a known, small set of subdomains
• Issue a separate certificate per subdomain — workable, but harder to manage at scale

At the redirect level, point www ↔ non-www in one consistent direction (pick one as canonical) and force HTTPS via .htaccess so visitors never get stuck on a version the certificate doesn't cover.

Frequently Asked Questions

SSL works on desktop but fails on mobile — why?

Usually a missing intermediate certificate. Some browsers fill in the chain themselves, others don't — reinstall the certificate with the full chain bundle.

I fixed the server but still see the same error

Open the site in an incognito window — some errors come from an old certificate cached on your device, not a server-side problem.

Which tools should I use to check SSL?

ssllabs.com/ssltest checks the chain and protocols in the most detail, while whynopadlock.com helps find mixed content, and the openssl s_client command checks the chain directly from your machine without any external website.

Does a Wildcard certificate cover the root domain too?

No — a Wildcard *.yourdomain.com only covers single-level subdomains, not the bare yourdomain.com. Most issuers add the root to the SAN for you, but confirm it before going live.