[{"data":1,"prerenderedAt":708},["ShallowReactive",2],{"content-query-tKTNSjNx9t":3},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"layout":10,"crumb":11,"summary":12,"group":13,"order":14,"updated":15,"cta":16,"related":24,"faq":43,"body":59,"_type":701,"_id":702,"_source":703,"_file":704,"_stem":705,"_extension":706,"sitemap":707},"/http-errors/err-cert-authority-invalid","http-errors",false,"","NET::ERR_CERT_AUTHORITY_INVALID: what it means and how to fix it","NET::ERR_CERT_AUTHORITY_INVALID means the browser doesn't trust the certificate's issuer: self-signed, missing intermediate or private CA. How to fix it.","reference","ERR_CERT_AUTHORITY_INVALID","The certificate isn't signed by a CA the browser trusts.","TLS and certificate errors",900,"2026-10-28",{"eyebrow":17,"title":18,"text":19,"to":20,"label":21,"secondaryTo":22,"secondaryLabel":23},"Webhook Relay","Receive webhooks without a public certificate","Webhook providers refuse endpoints with self-signed certificates. Webhook Relay gives you a public HTTPS endpoint and delivers to your server through an outbound connection, so the local or internal app can keep its own certificate, or plain HTTP. For self-signed destinations, TLS verification can be turned off per output.","/features/tls-compatibility/","See TLS compatibility","/docs/webhooks/tls-ssl-errors/","TLS error reference",[25,28,31,34,37,40],{"title":26,"to":27},"ERR_SSL_VERSION_OR_CIPHER_MISMATCH","/http-errors/err-ssl-version-or-cipher-mismatch/",{"title":29,"to":30},"502 Bad Gateway","/http-errors/502-bad-gateway/",{"title":32,"to":33},"Tunnel","/glossary/tunnel/",{"title":35,"to":36},"127.0.0.1 and the loopback address","/localhost/127-0-0-1/",{"title":38,"to":39},"Webhook endpoint","/glossary/webhook-endpoint/",{"title":41,"to":42},"Receive webhooks on localhost","/blog/receive-webhooks-on-localhost/",[44,47,50,53,56],{"q":45,"a":46},"What does NET::ERR_CERT_AUTHORITY_INVALID mean?","It means Chrome or Edge couldn't trace the site's TLS certificate back to a certificate authority it trusts. The certificate may be self-signed, issued by a private or corporate CA, or served without its intermediate certificate. The connection is encrypted, but the browser can't confirm who is on the other end.",{"q":48,"a":49},"How do I fix ERR_CERT_AUTHORITY_INVALID as a visitor?","Don't click through on sites that handle logins or payments. Try another network, since public Wi-Fi login pages and some corporate proxies intercept HTTPS. Check whether antivirus software with HTTPS scanning is installed, update your browser and operating system, and make sure your device's date and time are correct.",{"q":51,"a":52},"How do I fix ERR_CERT_AUTHORITY_INVALID on my server?","Install a certificate from a publicly trusted CA such as Let's Encrypt, and serve the full chain: your certificate plus the intermediates. In nginx point ssl_certificate at fullchain.pem, not cert.pem. Check the result with openssl s_client -connect example.com:443 -servername example.com -showcerts or an online SSL checker.",{"q":54,"a":55},"How do I fix ERR_CERT_AUTHORITY_INVALID on localhost?","Use a locally trusted certificate instead of a plain self-signed one. The mkcert tool creates a local CA, adds it to your system and browser trust stores, and issues certificates for localhost and 127.0.0.1. Or serve your dev app over plain HTTP and use a tunnel when you need a public HTTPS URL.",{"q":57,"a":58},"Can webhooks be sent to a server with a self-signed certificate?","Usually not. Most webhook providers verify the certificate and fail the delivery if it isn't publicly trusted. Use a certificate from a public CA, or put a relay in front: Webhook Relay receives on a public HTTPS endpoint and can deliver to a self-signed destination with TLS verification turned off for that output.",{"type":60,"children":61,"toc":695},"root",[62,91,138,143,200,207,269,289,295,352,358,375,400,405,455,476,494,537,594,600,605,610,679,689],{"type":63,"tag":64,"props":65,"children":66},"element","p",{},[67,81,83,89],{"type":63,"tag":68,"props":69,"children":70},"strong",{},[71,79],{"type":63,"tag":72,"props":73,"children":75},"code",{"className":74},[],[76],{"type":77,"value":78},"text","NET::ERR_CERT_AUTHORITY_INVALID",{"type":77,"value":80}," means the browser couldn't trace the site's certificate back to a certificate authority (CA) it trusts.",{"type":77,"value":82}," The certificate is self-signed, issued by a private or corporate CA, or served without the intermediate certificate that links it to a trusted root. Chrome and Edge show it as ",{"type":63,"tag":84,"props":85,"children":86},"em",{},[87],{"type":77,"value":88},"\"Your connection is not private\"",{"type":77,"value":90},".",{"type":63,"tag":92,"props":93,"children":96},"pre",{"className":94,"code":95,"language":77,"meta":7,"style":7},"language-text shiki shiki-themes github-dark","Your connection is not private\nAttackers might be trying to steal your information from example.com\n(for example, passwords, messages, or credit cards).\nNET::ERR_CERT_AUTHORITY_INVALID\n",[97],{"type":63,"tag":72,"props":98,"children":99},{"__ignoreMap":7},[100,111,120,129],{"type":63,"tag":101,"props":102,"children":105},"span",{"class":103,"line":104},"line",1,[106],{"type":63,"tag":101,"props":107,"children":108},{},[109],{"type":77,"value":110},"Your connection is not private\n",{"type":63,"tag":101,"props":112,"children":114},{"class":103,"line":113},2,[115],{"type":63,"tag":101,"props":116,"children":117},{},[118],{"type":77,"value":119},"Attackers might be trying to steal your information from example.com\n",{"type":63,"tag":101,"props":121,"children":123},{"class":103,"line":122},3,[124],{"type":63,"tag":101,"props":125,"children":126},{},[127],{"type":77,"value":128},"(for example, passwords, messages, or credit cards).\n",{"type":63,"tag":101,"props":130,"children":132},{"class":103,"line":131},4,[133],{"type":63,"tag":101,"props":134,"children":135},{},[136],{"type":77,"value":137},"NET::ERR_CERT_AUTHORITY_INVALID\n",{"type":63,"tag":64,"props":139,"children":140},{},[141],{"type":77,"value":142},"Other clients report the same problem in their own words:",{"type":63,"tag":92,"props":144,"children":146},{"className":94,"code":145,"language":77,"meta":7,"style":7},"Firefox:  SEC_ERROR_UNKNOWN_ISSUER\ncurl:     curl: (60) SSL certificate problem: unable to get local issuer certificate\ncurl:     curl: (60) SSL certificate problem: self-signed certificate\nNode.js:  Error: unable to verify the first certificate\nPython:   ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED]\nGo:       x509: certificate signed by unknown authority\n",[147],{"type":63,"tag":72,"props":148,"children":149},{"__ignoreMap":7},[150,158,166,174,182,191],{"type":63,"tag":101,"props":151,"children":152},{"class":103,"line":104},[153],{"type":63,"tag":101,"props":154,"children":155},{},[156],{"type":77,"value":157},"Firefox:  SEC_ERROR_UNKNOWN_ISSUER\n",{"type":63,"tag":101,"props":159,"children":160},{"class":103,"line":113},[161],{"type":63,"tag":101,"props":162,"children":163},{},[164],{"type":77,"value":165},"curl:     curl: (60) SSL certificate problem: unable to get local issuer certificate\n",{"type":63,"tag":101,"props":167,"children":168},{"class":103,"line":122},[169],{"type":63,"tag":101,"props":170,"children":171},{},[172],{"type":77,"value":173},"curl:     curl: (60) SSL certificate problem: self-signed certificate\n",{"type":63,"tag":101,"props":175,"children":176},{"class":103,"line":131},[177],{"type":63,"tag":101,"props":178,"children":179},{},[180],{"type":77,"value":181},"Node.js:  Error: unable to verify the first certificate\n",{"type":63,"tag":101,"props":183,"children":185},{"class":103,"line":184},5,[186],{"type":63,"tag":101,"props":187,"children":188},{},[189],{"type":77,"value":190},"Python:   ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED]\n",{"type":63,"tag":101,"props":192,"children":194},{"class":103,"line":193},6,[195],{"type":63,"tag":101,"props":196,"children":197},{},[198],{"type":77,"value":199},"Go:       x509: certificate signed by unknown authority\n",{"type":63,"tag":201,"props":202,"children":204},"h2",{"id":203},"common-causes",[205],{"type":77,"value":206},"Common causes",{"type":63,"tag":208,"props":209,"children":210},"ul",{},[211,222,239,249,259],{"type":63,"tag":212,"props":213,"children":214},"li",{},[215,220],{"type":63,"tag":68,"props":216,"children":217},{},[218],{"type":77,"value":219},"Self-signed certificate.",{"type":77,"value":221}," Common on dev servers, routers, NAS boxes, Home Assistant and internal tools.",{"type":63,"tag":212,"props":223,"children":224},{},[225,230,232,238],{"type":63,"tag":68,"props":226,"children":227},{},[228],{"type":77,"value":229},"Missing intermediate certificate.",{"type":77,"value":231}," The server sends only its own certificate, not the chain. Some browsers fill the gap by fetching the intermediate themselves, so the site works in one browser and fails in another, or in ",{"type":63,"tag":72,"props":233,"children":235},{"className":234},[],[236],{"type":77,"value":237},"curl",{"type":77,"value":90},{"type":63,"tag":212,"props":240,"children":241},{},[242,247],{"type":63,"tag":68,"props":243,"children":244},{},[245],{"type":77,"value":246},"Private or corporate CA.",{"type":77,"value":248}," An internal CA that your device doesn't have installed.",{"type":63,"tag":212,"props":250,"children":251},{},[252,257],{"type":63,"tag":68,"props":253,"children":254},{},[255],{"type":77,"value":256},"HTTPS interception.",{"type":77,"value":258}," Antivirus HTTPS scanning, a corporate proxy, or a public Wi-Fi login page re-signs traffic with its own certificate.",{"type":63,"tag":212,"props":260,"children":261},{},[262,267],{"type":63,"tag":68,"props":263,"children":264},{},[265],{"type":77,"value":266},"Outdated trust store.",{"type":77,"value":268}," Old devices that don't have newer root certificates.",{"type":63,"tag":64,"props":270,"children":271},{},[272,274,280,282,288],{"type":77,"value":273},"A wrong system clock usually shows ",{"type":63,"tag":72,"props":275,"children":277},{"className":276},[],[278],{"type":77,"value":279},"ERR_CERT_DATE_INVALID",{"type":77,"value":281}," instead, and a certificate for the wrong hostname shows ",{"type":63,"tag":72,"props":283,"children":285},{"className":284},[],[286],{"type":77,"value":287},"ERR_CERT_COMMON_NAME_INVALID",{"type":77,"value":90},{"type":63,"tag":201,"props":290,"children":292},{"id":291},"how-to-fix-it-as-a-visitor",[293],{"type":77,"value":294},"How to fix it as a visitor",{"type":63,"tag":296,"props":297,"children":298},"ol",{},[299,309,327,337,347],{"type":63,"tag":212,"props":300,"children":301},{},[302,307],{"type":63,"tag":68,"props":303,"children":304},{},[305],{"type":77,"value":306},"Don't click \"Proceed\"",{"type":77,"value":308}," on a site where you'll log in or pay.",{"type":63,"tag":212,"props":310,"children":311},{},[312,317,319,325],{"type":63,"tag":68,"props":313,"children":314},{},[315],{"type":77,"value":316},"Try another network.",{"type":77,"value":318}," If it works on mobile data, the Wi-Fi network is intercepting HTTPS. Open any ",{"type":63,"tag":72,"props":320,"children":322},{"className":321},[],[323],{"type":77,"value":324},"http://",{"type":77,"value":326}," page to trigger a captive portal login.",{"type":63,"tag":212,"props":328,"children":329},{},[330,335],{"type":63,"tag":68,"props":331,"children":332},{},[333],{"type":77,"value":334},"Check antivirus HTTPS scanning",{"type":77,"value":336}," and temporarily turn it off to test.",{"type":63,"tag":212,"props":338,"children":339},{},[340,345],{"type":63,"tag":68,"props":341,"children":342},{},[343],{"type":77,"value":344},"Update the browser and OS",{"type":77,"value":346}," so the trust store is current, and check your date and time.",{"type":63,"tag":212,"props":348,"children":349},{},[350],{"type":77,"value":351},"If it happens on one site only, it's the site's configuration. Tell the owner.",{"type":63,"tag":201,"props":353,"children":355},{"id":354},"how-to-fix-it-as-a-developer-or-ops",[356],{"type":77,"value":357},"How to fix it as a developer or ops",{"type":63,"tag":64,"props":359,"children":360},{},[361,366,368,373],{"type":63,"tag":68,"props":362,"children":363},{},[364],{"type":77,"value":365},"Public sites:",{"type":77,"value":367}," use a certificate from a public CA. Let's Encrypt is free and automated with Certbot, Caddy, Traefik or cert-manager on Kubernetes. Then ",{"type":63,"tag":68,"props":369,"children":370},{},[371],{"type":77,"value":372},"serve the full chain",{"type":77,"value":374},":",{"type":63,"tag":92,"props":376,"children":380},{"className":377,"code":378,"language":379,"meta":7,"style":7},"language-nginx shiki shiki-themes github-dark","ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;  # not cert.pem\nssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;\n","nginx",[381],{"type":63,"tag":72,"props":382,"children":383},{"__ignoreMap":7},[384,392],{"type":63,"tag":101,"props":385,"children":386},{"class":103,"line":104},[387],{"type":63,"tag":101,"props":388,"children":389},{},[390],{"type":77,"value":391},"ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;  # not cert.pem\n",{"type":63,"tag":101,"props":393,"children":394},{"class":103,"line":113},[395],{"type":63,"tag":101,"props":396,"children":397},{},[398],{"type":77,"value":399},"ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;\n",{"type":63,"tag":64,"props":401,"children":402},{},[403],{"type":77,"value":404},"Check what the server actually sends:",{"type":63,"tag":92,"props":406,"children":410},{"className":407,"code":408,"language":409,"meta":7,"style":7},"language-bash shiki shiki-themes github-dark","openssl s_client -connect example.com:443 -servername example.com -showcerts\n","bash",[411],{"type":63,"tag":72,"props":412,"children":413},{"__ignoreMap":7},[414],{"type":63,"tag":101,"props":415,"children":416},{"class":103,"line":104},[417,423,429,435,440,445,450],{"type":63,"tag":101,"props":418,"children":420},{"style":419},"--shiki-default:#B392F0",[421],{"type":77,"value":422},"openssl",{"type":63,"tag":101,"props":424,"children":426},{"style":425},"--shiki-default:#9ECBFF",[427],{"type":77,"value":428}," s_client",{"type":63,"tag":101,"props":430,"children":432},{"style":431},"--shiki-default:#79B8FF",[433],{"type":77,"value":434}," -connect",{"type":63,"tag":101,"props":436,"children":437},{"style":425},[438],{"type":77,"value":439}," example.com:443",{"type":63,"tag":101,"props":441,"children":442},{"style":431},[443],{"type":77,"value":444}," -servername",{"type":63,"tag":101,"props":446,"children":447},{"style":425},[448],{"type":77,"value":449}," example.com",{"type":63,"tag":101,"props":451,"children":452},{"style":431},[453],{"type":77,"value":454}," -showcerts\n",{"type":63,"tag":64,"props":456,"children":457},{},[458,460,466,468,474],{"type":77,"value":459},"Look for ",{"type":63,"tag":72,"props":461,"children":463},{"className":462},[],[464],{"type":77,"value":465},"Verify return code: 0 (ok)",{"type":77,"value":467},". ",{"type":63,"tag":72,"props":469,"children":471},{"className":470},[],[472],{"type":77,"value":473},"unable to get local issuer certificate",{"type":77,"value":475}," means the chain is incomplete.",{"type":63,"tag":64,"props":477,"children":478},{},[479,484,486,492],{"type":63,"tag":68,"props":480,"children":481},{},[482],{"type":77,"value":483},"Behind Cloudflare:",{"type":77,"value":485}," the visitor sees Cloudflare's certificate, so the origin's certificate only matters in Full (strict) mode. There, a self-signed origin causes ",{"type":63,"tag":72,"props":487,"children":489},{"className":488},[],[490],{"type":77,"value":491},"Error 526",{"type":77,"value":493},"; use a Cloudflare Origin CA certificate or a public one.",{"type":63,"tag":64,"props":495,"children":496},{},[497,502,504,513,515,521,523,528,530,535],{"type":63,"tag":68,"props":498,"children":499},{},[500],{"type":77,"value":501},"Local development:",{"type":77,"value":503}," a self-signed certificate will always trigger this error. Use ",{"type":63,"tag":505,"props":506,"children":510},"a",{"href":507,"rel":508},"https://github.com/FiloSottile/mkcert",[509],"nofollow",[511],{"type":77,"value":512},"mkcert",{"type":77,"value":514}," to create a locally trusted CA and certificate for ",{"type":63,"tag":72,"props":516,"children":518},{"className":517},[],[519],{"type":77,"value":520},"localhost",{"type":77,"value":522}," and ",{"type":63,"tag":505,"props":524,"children":525},{"href":36},[526],{"type":77,"value":527},"127.0.0.1",{"type":77,"value":529},", or serve plain HTTP locally and use a ",{"type":63,"tag":505,"props":531,"children":532},{"href":33},[533],{"type":77,"value":534},"tunnel",{"type":77,"value":536}," when you need a public HTTPS URL.",{"type":63,"tag":64,"props":538,"children":539},{},[540,545,547,553,555,561,563,569,571,577,579,585,586,592],{"type":63,"tag":68,"props":541,"children":542},{},[543],{"type":77,"value":544},"Internal services:",{"type":77,"value":546}," distribute your private CA to clients instead of disabling verification. For Node.js set ",{"type":63,"tag":72,"props":548,"children":550},{"className":549},[],[551],{"type":77,"value":552},"NODE_EXTRA_CA_CERTS",{"type":77,"value":554},", for Python ",{"type":63,"tag":72,"props":556,"children":558},{"className":557},[],[559],{"type":77,"value":560},"REQUESTS_CA_BUNDLE",{"type":77,"value":562}," or ",{"type":63,"tag":72,"props":564,"children":566},{"className":565},[],[567],{"type":77,"value":568},"SSL_CERT_FILE",{"type":77,"value":570},". Avoid ",{"type":63,"tag":72,"props":572,"children":574},{"className":573},[],[575],{"type":77,"value":576},"NODE_TLS_REJECT_UNAUTHORIZED=0",{"type":77,"value":578},", ",{"type":63,"tag":72,"props":580,"children":582},{"className":581},[],[583],{"type":77,"value":584},"curl -k",{"type":77,"value":522},{"type":63,"tag":72,"props":587,"children":589},{"className":588},[],[590],{"type":77,"value":591},"verify=False",{"type":77,"value":593}," outside a quick local test.",{"type":63,"tag":201,"props":595,"children":597},{"id":596},"on-a-webhook-endpoint",[598],{"type":77,"value":599},"On a webhook endpoint",{"type":63,"tag":64,"props":601,"children":602},{},[603],{"type":77,"value":604},"Webhook providers verify your endpoint's certificate the same way a browser does, and they don't show a \"proceed anyway\" button. A self-signed or incomplete-chain certificate means every delivery fails, often logged on the provider side only as a TLS or connection error.",{"type":63,"tag":64,"props":606,"children":607},{},[608],{"type":77,"value":609},"You have three options:",{"type":63,"tag":208,"props":611,"children":612},{},[613,623,648],{"type":63,"tag":212,"props":614,"children":615},{},[616,621],{"type":63,"tag":68,"props":617,"children":618},{},[619],{"type":77,"value":620},"Fix the certificate",{"type":77,"value":622}," on a public endpoint: public CA, full chain.",{"type":63,"tag":212,"props":624,"children":625},{},[626,631,633,639,641,647],{"type":63,"tag":68,"props":627,"children":628},{},[629],{"type":77,"value":630},"Don't expose the server at all.",{"type":77,"value":632}," ",{"type":63,"tag":72,"props":634,"children":636},{"className":635},[],[637],{"type":77,"value":638},"relay forward --bucket my-app http://localhost:3000/webhooks",{"type":77,"value":640}," gives providers a public HTTPS webhook URL, and the agent delivers to your local or internal app over an outbound connection, so the app needs no public certificate. See ",{"type":63,"tag":505,"props":642,"children":644},{"href":643},"/docs/webhooks/internal/localhost/",[645],{"type":77,"value":646},"receive webhooks on localhost",{"type":77,"value":90},{"type":63,"tag":212,"props":649,"children":650},{},[651,656,658,663,665,671,673,678],{"type":63,"tag":68,"props":652,"children":653},{},[654],{"type":77,"value":655},"Deliver to a self-signed destination you control.",{"type":77,"value":657}," Webhook Relay outputs have a ",{"type":63,"tag":68,"props":659,"children":660},{},[661],{"type":77,"value":662},"TLS verification",{"type":77,"value":664}," toggle under Delivery controls. Turning it off for one internal destination lets webhooks through instead of failing with ",{"type":63,"tag":72,"props":666,"children":668},{"className":667},[],[669],{"type":77,"value":670},"certificate verify failed",{"type":77,"value":672},". Only do this for destinations you trust, typically on a private network. Details are in the ",{"type":63,"tag":505,"props":674,"children":675},{"href":22},[676],{"type":77,"value":677},"TLS/SSL error reference",{"type":77,"value":90},{"type":63,"tag":64,"props":680,"children":681},{},[682,684,688],{"type":77,"value":683},"If the error is about protocol versions or ciphers rather than trust, see ",{"type":63,"tag":505,"props":685,"children":686},{"href":27},[687],{"type":77,"value":26},{"type":77,"value":90},{"type":63,"tag":690,"props":691,"children":692},"style",{},[693],{"type":77,"value":694},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":122,"depth":122,"links":696},[697,698,699,700],{"id":203,"depth":113,"text":206},{"id":291,"depth":113,"text":294},{"id":354,"depth":113,"text":357},{"id":596,"depth":113,"text":599},"markdown","content:http-errors:err-cert-authority-invalid.md","content","http-errors/err-cert-authority-invalid.md","http-errors/err-cert-authority-invalid","md",{"loc":4},1793199803476]