Fix Browser Certificate Error on Internal Company Site Fast

You're not the first to see this

That red padlock, the "Your connection is not private" page, the error code like ERR_CERT_AUTHORITY_INVALID — it's annoying and it blocks work. Most of the time the fix is straightforward, and I'll show you the exact steps I use when a client calls me about this.

The quick fix: Check the system clock

Seriously. I've had a client last month whose internal HR site was throwing SEC_ERROR_UNKNOWN_ISSUER in Firefox. Took me two minutes — their server clock was off by 3 hours. Browsers compare the certificate's valid date range against your system clock. If they don't match, you get the scary warning.

1. On Windows, right-click the clock in the taskbar, select "Adjust date/time".
2. Turn on "Set time automatically" and "Set time zone automatically".
3. If that doesn't work, hit "Sync now" under Additional settings.
4. On a Mac, go to System Settings > General > Date & Time and enable "Set date and time automatically".

If the clock is correct but the error persists, move on.

The real fix: Install the internal CA certificate

Most internal sites use a certificate signed by the company's own Certificate Authority (CA). Your browser doesn't trust that CA by default — you need to install the CA's root certificate into your trusted store. Skip the "advanced" button and "proceed anyway" — that's a band-aid, and it won't work for all internal sites.

Step-by-step for Windows (10/11)

1. Open the site in Chrome or Edge. Click the padlock icon next to the URL, then click "Certificate" (or "Connection is not secure" > "Certificate information").
2. In the Certificate dialog, go to the "Certification Path" tab. You'll see a chain — the top entry is the root CA.
3. Select that root CA, then click "View Certificate".
4. Go to the "Details" tab, then click "Copy to File". Save it as a Base-64 encoded .cer file.
5. Open certlm.msc (Local Machine certificate store) as Administrator.
6. Expand "Trusted Root Certification Authorities" > "Certificates".
7. Right-click > "All Tasks" > "Import". Browse to that .cer file and finish the wizard.
8. Restart your browser. The error should be gone.

Step-by-step for Mac

1. Export the root CA cert the same way from Safari or Chrome, but save it as .crt or .pem.
2. Open Keychain Access (Applications > Utilities).
3. Drag the .crt file into the "System" keychain (unlock first with your admin password).
4. Double-click the imported certificate, expand "Trust", and set "When using this certificate" to "Always Trust".

If you're in a corporate domain, your IT team should push this via Group Policy. If they haven't, send them this article.

Why this works

Your browser has a built-in list of trusted root CAs — companies like DigiCert, Let's Encrypt, Comodo. Your internal CA isn't on that list. By installing the internal root cert, you're telling the browser "yes, I trust this authority." It's not a hack — it's the proper solution. The clock fix matters because certificates have a valid-from and valid-to date range. If your clock is outside that window, even a trusted certificate looks invalid.

Less common variations

Hostname mismatch

The certificate was issued for "server.internal.company.com", but you're accessing it via IP address or a different hostname like "intranet". The error will say something like ERR_CERT_COMMON_NAME_INVALID. Fix: access the site using its full internal DNS name. If you don't know it, ask your IT team or check the certificate's "Subject" field.

Expired internal certificate

Internal CAs can issue certs that expire — sometimes they expire faster than external ones. If the site worked yesterday and now it doesn't, check the certificate's "Valid To" date. If expired, the IT team needs to renew it.

Firefox doesn't use the Windows store

Firefox has its own certificate store. If you installed the root CA in Windows but Firefox still shows SEC_ERROR_UNKNOWN_ISSUER, you need to import the cert into Firefox specifically. Go to Firefox Settings > Privacy & Security > Certificates > View Certificates > Import. Select the .cer file and restart Firefox.

Self-signed certificate on a dev server

Developers often create self-signed certs for testing. Your browser hates them. The fix: either use the hostname the cert was made for, or generate a proper internal CA-signed cert. If you're stuck, you can temporarily add an exception — but don't rely on that in production.

Prevention for the future

The best fix is to have your IT team run an internal Certificate Authority that's properly distributed. On Windows domains, push the root CA via Group Policy. On Macs, use a configuration profile. That way every machine trusts internal sites out of the box. Also — set up time sync via NTP on all servers and workstations. A lot of certificate errors are really just clock problems in disguise.

One more thing: if you're a small business running your own internal server with a self-signed cert, consider using a free service like Let's Encrypt with DNS validation. It's external, trusted, and works for internal hostnames if you control the DNS. I've done that for three clients this year alone — no more certificate errors.

"The best certificate error fix is the one you don't have to deal with again."