LightAtom

NET::ERR_CERT_AUTHORITY_INVALID: How to Fix It

The site's certificate wasn't issued by an authority your browser trusts: it's self-signed, the chain is incomplete, or software on your Mac replaced it.

NET::ERR_CERT_AUTHORITY_INVALID

The certificate is signed by someone your browser doesn't recognise as a trusted certificate authority, so it can't confirm the site is genuine.

Quick checks

  • Is it a device on your own network (router, NAS, printer)? Those usually use self-signed certificates.
  • Does it happen on every site? Then software or a network is intercepting HTTPS.
  • Check the date and time on your Mac.

Fixes on Mac

  1. Check who issued the certificate

    1. Click the icon left of the address › certificate details and look at the issuer. An antivirus, proxy or company name means it's being intercepted.

  2. Disable HTTPS interception

    1. Pause antivirus web protection, parental controls or debugging proxies and reload.
    2. Remove old proxy root certificates in Keychain Access › System or login › Certificates.

  3. For your own devices

    1. For a router or NAS you trust, you can proceed, or install its certificate and set it to Always Trust in Keychain Access.
    2. Better: give the device a real certificate (many NAS systems support Let's Encrypt).

Fixes on Windows

  1. Check security software

    1. Turn off HTTPS scanning to test; check the certificate's issuer in the browser.

Other devices

  1. Older phones

    1. Devices that no longer get updates can lack current root certificates; update the OS or browser.

Still not working?

Site owners: make sure your server sends the full chain: your certificate plus intermediates (for example fullchain.pem with Let's Encrypt, not cert.pem). Missing intermediates work in some browsers that cached them and fail in others, which makes the bug look random.

See what’s happening

LightAtom's connections view shows whether your browser connects to a proxy address instead of the site's servers, and which process runs that proxy.

Frequently asked questions

What does ERR_CERT_AUTHORITY_INVALID mean?

The browser couldn't trace the site's certificate to a trusted root authority. It may be self-signed, missing an intermediate certificate, or issued by interception software.

Is it safe to proceed?

For your own router or NAS on your home network, generally yes. For any public website, especially one asking for a login, no.

Why does my antivirus cause certificate errors?

Antivirus HTTPS scanning decrypts traffic using its own root certificate. If that root isn't trusted by the browser (Firefox keeps its own list), every site fails.

Related errors and tools

Related

LightAtom team

The people who build LightAtom, a network monitor for macOS.