Browser Says Not Secure Even With Valid Certificate
Your site has a valid SSL but the browser still says Not Secure. Usually a certificate chain issue or mixed content, not a hack.
Quick Answer
Check if your server is sending the full certificate chain (including intermediate certificates). Use SSL Labs test to confirm.
Why This Happens
You bought a certificate from a trusted CA, installed it, but the browser still shows "Not Secure". This happens more often than you think. The browser trusts the CA, but it doesn't trust your server's certificate because the chain is broken. The server only sends the leaf certificate (your site's cert) without the intermediate certificate(s) that link it to the root CA the browser trusts. Or your site has mixed content – some assets (images, scripts) are loaded over HTTP instead of HTTPS. I had a client last month whose entire print queue died because of this – well, not the queue, but their WordPress site loaded a font over HTTP and Chrome flagged everything as insecure.
Fix Steps
Step 1: Test the Certificate Chain
Go to SSL Labs and enter your domain. Run the test. Look at the Certificate Path section. If it shows a red X or says "Additional certificates are required", you're missing intermediate certs. The fix is to bundle them correctly.
Step 2: Reinstall the Certificate with the Full Chain
If you're using Apache or Nginx, you need to concatenate the leaf certificate and the intermediate certificates into one file. The order matters: your domain cert first, then the intermediate, then the root (usually optional). On Apache, in your VirtualHost config:
SSLCertificateFile /path/to/your_domain.crt
SSLCertificateKeyFile /path/to/your_domain.key
SSLCertificateChainFile /path/to/intermediate.crt # or bundle everything into your_domain.crtOn IIS, you need to import the intermediate certificate into the Intermediate Certification Authorities store. Open MMC, add the Certificates snap-in for the computer account, import the intermediate .cer file there.
Step 3: Check for Mixed Content
Open your site in Chrome. Open DevTools (F12), go to the Console tab. Look for red errors like Mixed Content: The page at 'https://...' was loaded over HTTPS, but requested an insecure resource 'http://...'. Fix those by changing http:// to https:// in your code. If you're using a CMS, install a plugin that fixes insecure content (like Really Simple SSL for WordPress).
Step 4: Check the Certificate's Common Name (CN) or SAN
The certificate's Common Name (CN) or Subject Alternative Name (SAN) must match the domain you're browsing. If your certificate is for www.example.com and you're visiting example.com (without www), it will show Not Secure. Get a certificate that covers both, or redirect one to the other.
Alternative Fixes
If the above steps didn't work, try these:
- Clear browser cache – cached certificate data can cause false warnings on some browsers. Test in incognito mode too.
- Check the date and time on your server. If it's wrong (like 2018), the browser thinks the certificate is expired or not yet valid. Had a client where the server clock was off by 2 years – took me 20 minutes to find.
- Use a different certificate authority. Some cheap or free CAs might not be trusted by all browsers (unlikely but possible). Stick with Let's Encrypt, DigiCert, or Comodo.
- Check for HSTS headers – if you have HSTS enabled and the certificate fails, the browser may refuse to connect entirely. Temporarily disable HSTS for testing.
Prevention Tip
Always test your certificate chain immediately after installation using SSL Labs. Set up monitoring that alerts you when the certificate is about to expire (e.g., 30 days before). For mixed content, use a Content Security Policy (CSP) header that blocks insecure requests. The CSP header block-all-mixed-content will help catch issues during development. And never skip the intermediate certificates – they're not optional.
Was this solution helpful?