DocsICP FilingConsole
官方文档
首页

How do I fix certificate errors shown in my browser?

更新时间：
复制 MD 格式
产品详情
我的收藏

After you deploy an SSL certificate to a web server, browsers may display errors such as "connection not secure", "site can't be reached", or "unsupported protocol". Common causes include certificate expiration, domain mismatch, blocked ports, or outdated TLS versions.

"Your connection to this site is not secure"

Possible cause: Stale browser cache, certificate-domain mismatch, or expired certificate.

Solutions:

  • Clear your browser cache and revisit the website.

  • Verify that the domain bound to the SSL certificate matches the domain you are accessing.

    Option A: Check in the Certificate Management Service console

    • Log in to the Certificate Management Service console.

    • In the navigation pane on the left, choose Certificate Management > SSL Certificate Management.

    • On the SSL Certificate Management page, locate the deployed certificate and verify that the bound domain matches the site domain. If they do not match, upload the correct certificate for the domain.

    Option B: Check in the browser

    • Visit the website domain and click the padlock icon in the browser address bar.

    • Click Certificate is not valid.

    • In the certificate details, verify that the Common Name (CN) matches the website domain.

  • Check whether the SSL certificate has expired.

    SSL certificates are valid for one year by default. If a "not secure" warning appears after a subsequent deployment, the certificate may have expired. Check the expiration date using one of the following methods.

    Option A: Check in the Certificate Management Service console

    Option B: Check in the browser

    • Visit the website domain and click the padlock icon in the browser address bar.

    • Click Certificate is not valid.

    • In the certificate details, check the expiration date.

  • Verify that the SSL certificate format is correct.

    Different web servers require different certificate formats. For more information, see Deploy a certificate.

Possible cause: Incorrect certificate path or filename in the configuration file.

Solutions:

Verify that the certificate path and filename in the web server configuration file match the actual files on the server. NGINX example:

server {
    listen 443 ssl;
    server_name example.com;

    #Replace the following paths with your actual SSL certificate and private key file paths
    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;

    # Other configurations...
}

Possible cause: The web server still uses an old certificate after a new one was purchased.

Solutions:

Create a deployment task to upload the new certificate to the server, or replace the old certificate file at the configured path. For more information, see Deploy SSL certificates to ECS and Simple Application Server.

"This site can't be reached"

Possible cause: Port 443 is not open.

Solutions:

  • If you use an Alibaba Cloud Elastic Compute Service (ECS) instance, go to the Security Groups page in the ECS console to open port 443. For detailed steps on configuring security groups, see Add a security group rule.

    Note

    Default ports (HTTP 80, HTTPS 443) do not require a port number in the URL. For non-default ports, use the format http://domain_name:port_number or https://domain_name:port_number.

  • Verify that HTTPS port 443 is open. If you use a non-standard port, confirm it is open and not occupied by other services.

  • If a firewall is configured, verify that it does not block external access to port 443.

  • For non-Alibaba Cloud servers, refer to your provider's security configuration guide to open port 443.

Possible cause: Incorrect web server configuration.

Solutions:

  • Verify that SSL/TLS directives are correctly configured and port 443 is being listened on.

  • Check the configuration file for syntax errors.

Possible cause: The SSL certificate has expired or was not properly issued.

Solutions:

  • Check whether the certificate has expired. If it has, renew it promptly. For more information, see SSL certificate renewal and expiration.

  • Verify that the certificate was properly issued and the bound domain matches the domain you are accessing.

Possible cause: DNS resolution issue.

Solutions:

  • Verify that the domain resolves to the correct server IP address. You can use the ping or nslookup command to check DNS resolution.

  • If you use a CDN service, verify that the CDN is correctly configured and does not block HTTPS traffic.

Note

If the issue persists, check web server and application logs. Try accessing from another device or network to rule out local issues. If you need further assistance, . You can also contact a product technical expert for assistance. For more information, see One-on-one Expert Service.

"Uses an unsupported protocol"

Possible cause: The web server uses deprecated protocol versions (SSL 2.0/3.0, TLS 1.0/1.1) or a TLS version incompatible with the client OS.

Solutions:

  • Enable TLS 1.2 or TLS 1.3 in your web server configuration. Ensure the client supports the configured version. NGINX example:

    server {
    listen 443 ssl;
    server_name yourdomain.com;

    # SSL certificate and private key paths
    ssl_certificate /path/to/your_certificate.crt;
    ssl_certificate_key /path/to/your_private.key;

    # Set supported SSL/TLS protocol versions
    ssl_protocols TLSv1.2 TLSv1.3;

    # Optional: Set more secure cipher suites
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';

    location / {
        root /var/www/html;
        index index.html index.htm;
    }
}

  • Ensure the server cipher suites are compatible with the client OS TLS version. The following steps apply to Windows.

    1. Open Control Panel and click Network and Internet.

    2. In the Network and Internet panel, click Internet Options, and then click the Advanced tab.

    3. Select TLS 1.2 or TLS 1.3 for better security and compatibility.

"Parts of this page are not secure (such as images)" or external resources fail to load

Possible cause: The website source code references resources over HTTP.

Solutions:

  • Replace HTTP resource URLs with HTTPS so all external resources (images, scripts, stylesheets) load over HTTPS.

  • For resources on the same domain, use relative URLs. The browser automatically uses the current page protocol.

  • If third-party resources do not support HTTPS, remove the HTTP references, redeploy, and verify the website.

Note

Implementation varies by website. Modify the code for your specific scenario. If you need assistance, . You can also contact a product technical expert for assistance. For more information, see One-on-one Expert Service.

Browser displays a message that the website has not completed its ICP filing

Possible cause: The ICP filing is not complete.

Solutions:

  • Use the Alibaba Cloud Network Diagnostic Tool to check whether your website has an ICP filing.

  • If you use the Alibaba Cloud ICP Filing system, go to the Alibaba Cloud ICP Filing system to apply for an ICP filing for your website. For more information, see ICP filing process.

  • If you do not use the Alibaba Cloud ICP Filing system, go to the system of your filing service provider to apply for an ICP filing for your website.

Previous：Why did my SSL certificate deployment fail?Next：How to resolve an incomplete SSL certificate chain for a website