Webhook Relay

NET::ERR_CERT_AUTHORITY_INVALID: what it means and how to fix it

NET::ERR_CERT_AUTHORITY_INVALID means the browser couldn't trace the site's certificate back to a certificate authority (CA) it trusts. The certificate is self-signed, issued by a private or corporate CA, or served without the intermediate certificate that links it to a trusted root. Chrome and Edge show it as "Your connection is not private".

Your connection is not private
Attackers might be trying to steal your information from example.com
(for example, passwords, messages, or credit cards).
NET::ERR_CERT_AUTHORITY_INVALID

Other clients report the same problem in their own words:

Firefox:  SEC_ERROR_UNKNOWN_ISSUER
curl:     curl: (60) SSL certificate problem: unable to get local issuer certificate
curl:     curl: (60) SSL certificate problem: self-signed certificate
Node.js:  Error: unable to verify the first certificate
Python:   ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED]
Go:       x509: certificate signed by unknown authority

Common causes

  • Self-signed certificate. Common on dev servers, routers, NAS boxes, Home Assistant and internal tools.
  • Missing intermediate certificate. The server sends only its own certificate, not the chain. Some browsers fill the gap by fetching the intermediate themselves, so the site works in one browser and fails in another, or in curl.
  • Private or corporate CA. An internal CA that your device doesn't have installed.
  • HTTPS interception. Antivirus HTTPS scanning, a corporate proxy, or a public Wi-Fi login page re-signs traffic with its own certificate.
  • Outdated trust store. Old devices that don't have newer root certificates.

A wrong system clock usually shows ERR_CERT_DATE_INVALID instead, and a certificate for the wrong hostname shows ERR_CERT_COMMON_NAME_INVALID.

How to fix it as a visitor

  1. Don't click "Proceed" on a site where you'll log in or pay.
  2. Try another network. If it works on mobile data, the Wi-Fi network is intercepting HTTPS. Open any http:// page to trigger a captive portal login.
  3. Check antivirus HTTPS scanning and temporarily turn it off to test.
  4. Update the browser and OS so the trust store is current, and check your date and time.
  5. If it happens on one site only, it's the site's configuration. Tell the owner.

How to fix it as a developer or ops

Public sites: use a certificate from a public CA. Let's Encrypt is free and automated with Certbot, Caddy, Traefik or cert-manager on Kubernetes. Then serve the full chain:

ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;  # not cert.pem
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

Check what the server actually sends:

openssl s_client -connect example.com:443 -servername example.com -showcerts

Look for Verify return code: 0 (ok). unable to get local issuer certificate means the chain is incomplete.

Behind Cloudflare: the visitor sees Cloudflare's certificate, so the origin's certificate only matters in Full (strict) mode. There, a self-signed origin causes Error 526; use a Cloudflare Origin CA certificate or a public one.

Local development: a self-signed certificate will always trigger this error. Use mkcert to create a locally trusted CA and certificate for localhost and 127.0.0.1, or serve plain HTTP locally and use a tunnel when you need a public HTTPS URL.

Internal services: distribute your private CA to clients instead of disabling verification. For Node.js set NODE_EXTRA_CA_CERTS, for Python REQUESTS_CA_BUNDLE or SSL_CERT_FILE. Avoid NODE_TLS_REJECT_UNAUTHORIZED=0, curl -k and verify=False outside a quick local test.

On a webhook endpoint

Webhook providers verify your endpoint's certificate the same way a browser does, and they don't show a "proceed anyway" button. A self-signed or incomplete-chain certificate means every delivery fails, often logged on the provider side only as a TLS or connection error.

You have three options:

  • Fix the certificate on a public endpoint: public CA, full chain.
  • Don't expose the server at all. relay forward --bucket my-app http://localhost:3000/webhooks gives providers a public HTTPS webhook URL, and the agent delivers to your local or internal app over an outbound connection, so the app needs no public certificate. See receive webhooks on localhost.
  • Deliver to a self-signed destination you control. Webhook Relay outputs have a TLS verification toggle under Delivery controls. Turning it off for one internal destination lets webhooks through instead of failing with certificate verify failed. Only do this for destinations you trust, typically on a private network. Details are in the TLS/SSL error reference.

If the error is about protocol versions or ciphers rather than trust, see ERR_SSL_VERSION_OR_CIPHER_MISMATCH.

Frequently asked questions

What does NET::ERR_CERT_AUTHORITY_INVALID mean?

It means Chrome or Edge couldn't trace the site's TLS certificate back to a certificate authority it trusts. The certificate may be self-signed, issued by a private or corporate CA, or served without its intermediate certificate. The connection is encrypted, but the browser can't confirm who is on the other end.

How do I fix ERR_CERT_AUTHORITY_INVALID as a visitor?

Don't click through on sites that handle logins or payments. Try another network, since public Wi-Fi login pages and some corporate proxies intercept HTTPS. Check whether antivirus software with HTTPS scanning is installed, update your browser and operating system, and make sure your device's date and time are correct.

How do I fix ERR_CERT_AUTHORITY_INVALID on my server?

Install a certificate from a publicly trusted CA such as Let's Encrypt, and serve the full chain: your certificate plus the intermediates. In nginx point ssl_certificate at fullchain.pem, not cert.pem. Check the result with openssl s_client -connect example.com:443 -servername example.com -showcerts or an online SSL checker.

How do I fix ERR_CERT_AUTHORITY_INVALID on localhost?

Use a locally trusted certificate instead of a plain self-signed one. The mkcert tool creates a local CA, adds it to your system and browser trust stores, and issues certificates for localhost and 127.0.0.1. Or serve your dev app over plain HTTP and use a tunnel when you need a public HTTPS URL.

Can webhooks be sent to a server with a self-signed certificate?

Usually not. Most webhook providers verify the certificate and fail the delivery if it isn't publicly trusted. Use a certificate from a public CA, or put a relay in front: Webhook Relay receives on a public HTTPS endpoint and can deliver to a self-signed destination with TLS verification turned off for that output.

Related