Skip to content
Cloudflare Docs

General SSL errors

Let's Encrypt chain update

Section titled “Let's Encrypt chain update”

Symptom

Section titled “Symptom”

Starting September 9, 2024, visitors that try to connect to your website using older devices - for example, Android 7.0 and earlier - have access problems or reach security warnings.

Resolution

Section titled “Resolution”

The fastest way to resolve this issue is to change your certificate to use Google Trust Services as the certificate authority.

Outdated browsers

Section titled “Outdated browsers”

Symptom

Section titled “Symptom”

Until Cloudflare provides an SSL certificate for your domain, the following errors may appear in various browsers for HTTPS traffic:

  • Firefox: _ssl_error_bad_cert_domain / This connection is untrusted
  • Chrome: Your connection is not private
  • Safari: Safari can't verify the identity of the website
  • Edge / Internet Explorer: There is a problem with this website's security certificate

Resolution

Section titled “Resolution”

Even with a Cloudflare SSL certificate provisioned for your domain, older browsers display errors about untrusted SSL certificates because they do not support the Server Name Indication (SNI) protocol ↗ used by Cloudflare Universal SSL certificates.

To solve, determine if the browser supports SNI ↗. If not, upgrade your browser.

Only some of your subdomains return SSL errors

Section titled “Only some of your subdomains return SSL errors”

Symptom

Section titled “Symptom”

Cloudflare Universal SSL certificates only cover the apex domain (example.com) and one level of subdomains (blog.example.com). If visitors to your domain observe errors accessing a second level of subdomains in their browser (such as dev.www.example.com) but not the first level of subdomains, resolve the issue using one of the following methods below.

Resolution

Section titled “Resolution”

Your Cloudflare Universal SSL certificate is not active

Section titled “Your Cloudflare Universal SSL certificate is not active”

Symptom

Section titled “Symptom”

All active Cloudflare domains are provided a Universal SSL certificate. If you observe SSL errors and do not have a certificate of Type Universal within the Edge Certificates tab of the Cloudflare SSL/TLS app for your domain, the Universal SSL certificate has not yet provisioned.

Our SSL vendors verify each SSL certificate request before Cloudflare can issue a certificate for a domain name. This process may take anywhere from 15 minutes to 24 hours. Our SSL certificate vendors sometimes flag a domain name for additional review.

Resolution

Section titled “Resolution”

No Universal certificate

Section titled “No Universal certificate”

If your Cloudflare SSL certificate is not issued within 24 hours of Cloudflare domain activation:

Temporarily pausing Cloudflare will allow the HTTPS traffic to be served properly from your origin web server while the support team investigates the issue.

Full DNS setup

Section titled “Full DNS setup”

If your domain is on a full setup, review your DNS records.

Cloudflare SSL/TLS certificates only apply for traffic proxied through Cloudflare. If SSL errors only occur for hostnames not proxied to Cloudflare, proxy those hostnames through Cloudflare.

Partial DNS setup

Section titled “Partial DNS setup”

If your domain is on a partial setup, confirm whether you have CAA DNS records enabled at your current hosting provider. If so, ensure you specify the Certificate Authorities that Cloudflare uses to provision certificates for your domain.

OCSP response error

Section titled “OCSP response error”

Symptom

Section titled “Symptom”

Visitors to your site observe an OCSP response error.

Resolution

Section titled “Resolution”

This error is either caused by the browser version or an issue requiring attention by one of Cloudflare’s SSL vendors. In order to properly diagnose, contact Support with the following information provided by the visitor that observes the browser error:

  1. The output from https://aboutmybrowser.com/ ↗  .
  2. The output of https://<YOUR_DOMAIN>/cdn-cgi/trace from the visitor’s browser.

Incorrect HSTS headers

Section titled “Incorrect HSTS headers”

Symptom

Section titled “Symptom”

The HSTS headers (Strict-Transport-Security and X-Content-Type-Options) in the response do not match the configuration settings defined in your HSTS settings.

Resolution

Section titled “Resolution”

You may have configured Response Header Transform Rules that are overriding the HSTS header values defined in the SSL/TLS app.

  1. Go to Rules > Overview.
  2. Under Response Header Transform Rules, search for a rule setting the value of one of the HSTS headers (Strict-Transport-Security or X-Content-Type-Options).
  3. Delete (or edit) the rule so that the HSTS configuration settings defined in the SSL/TLS app are applied.
  4. Repeat this procedure for the other HSTS header.

Other errors

Section titled “Other errors”

Symptom

Section titled “Symptom”

You are getting the error NET::ERR_CERT_COMMON_NAME_INVALID in your browser.

Resolution

Section titled “Resolution”

Kaspersky Antivirus

Section titled “Kaspersky Antivirus”

To avoid SSL errors with the Cloudflare dashboard when using Kaspersky Antivirus, allow dash.cloudflare.com in Kaspersky.