Fix 'Connection Not Secure' on Windows 10 — 3 Real Causes

That "Your connection is not secure" page in Chrome or Edge is a pain, but nine times out of ten it's a stupid simple fix. The error code usually points you in the right direction — NET::ERR_CERT_DATE_INVALID means the date's wrong, NET::ERR_CERT_AUTHORITY_INVALID means a broken or missing intermediate cert, and sometimes it's malware hijacking your HTTPS. I've fixed this on hundreds of machines. Don't go reinstalling the browser or running a system restore yet. Work through these in order.

Cause #1: The system clock is off

This is the #1 cause. The certificate on the site is only valid for a specific date range. If your PC's clock is even a few minutes wrong, the browser flips out and shows that error. I've seen it happen after a CMOS battery died or after a Windows update failed to sync time.

The fix:

1. Right-click the clock in the taskbar and select "Adjust date/time".
2. Turn off "Set time automatically" and turn it back on. Wait a few seconds.
3. If it still doesn't sync, click "Sync now" under the time zone settings.
4. If that fails, open Command Prompt as admin and run:

   w32tm /resync

Check the date and time zone are actually right. If the time zone is off by a few hours, that's enough to break HTTPS on some sites. Also double-check the year — a wrong year is the classic stale CMOS battery symptom. If the clock keeps resetting after every reboot, you need to replace that battery. It's a $5 part on most desktops.

After fixing time, clear the browser's SSL cache. In Chrome: Settings > Privacy and security > Security > Manage certificates > Advanced > Clear certificates. Or just close the browser and run certutil -delete -store My in an admin command prompt if you're comfortable with that.

Cause #2: Missing intermediate certificates

If the date is fine, the next usual suspect is a broken chain of trust. The site's server sends its leaf certificate, but your PC is missing the intermediate CA certificate that connects it to the root. This happens more on corporate networks or after you've manually deleted a cert that Windows Update needed.

The fix: Update the root certificates. Microsoft releases updates for the Trusted Root CA list regularly. Go to Windows Update and install all pending updates. If that doesn't do it, you can manually download the root certificate update from Microsoft.

Also check if the site's certificate is actually expired. Open the browser's padlock icon (or click the error page's "Details" link) and look at the valid dates. If the site's cert expired, that's on the website owner, not you. Try a different browser to confirm — if Firefox loads it fine, it's a Chrome/Edge store issue.

For intermediate certs, you can sometimes trace the chain using openssl s_client -connect example.com:443 if you have OpenSSL installed. But for most people, the Windows Update fix handles it. Don't bother manually installing random CA certs from the internet — that's how you end up with a broken trust store.

Cause #3: Malware intercepting HTTPS traffic

Less common, but when it happens it's serious. Adware or trojans install a fake root certificate so they can decrypt your HTTPS traffic and spy on you. The browser sees the cert is unsupported and throws the error. You'll see this on all browsers, not just one.

The fix: Run a full malware scan. Windows Defender's offline scan is a decent start:

1. Open Windows Security > Virus & threat protection.
2. Click "Scan options" and choose "Microsoft Defender Offline Scan".
3. That runs a deep scan at boot.

Also check for suspicious certificates in the Windows Certificate Store. Open certmgr.msc, go to Trusted Root Certification Authorities > Certificates. Look for anything with a weird name or a company that isn't a known CA. If you see something like "Superfish" or "2020 Certificate", delete it. Google's Superfish fiasco from 2015 was exactly this — Lenovo shipped adware with a self-signed cert.

If you're on a corporate laptop, sometimes the IT department's DLP software or proxy uses its own cert. Ask your admins before deleting anything that looks official.

After cleaning, reset the browser's SSL state. In Internet Options > Content > Clear SSL state. That removes all cached certs and forces a fresh handshake.

Quick Reference

Start with the clock, because it's free and takes a minute. If that's fine, do the Windows Update path. Only then start worrying about malware. Most of the time you'll stop after step one.