5 min readcode.live
SSL Certificate Errors: The Five You'll Actually Hit
Expired, self-signed, hostname mismatch, incomplete chain, wrong SAN — how to tell them apart fast and fix each one.
Diagnose before you panic
Most certificate errors fall into a handful of categories, and the browser's error message usually tells you which one directly — read it before reaching for a search engine.
The five
- Expired certificate — check the notAfter date, renew, and confirm the new cert actually got deployed (a stale reverse proxy cache is a common trap)
- Self-signed / untrusted issuer — fine for local dev, never for production; the chain doesn't lead back to a trusted root
- Hostname mismatch — the cert's CN/SAN doesn't include the domain you're visiting, common after a redirect to a different subdomain
- Incomplete chain — the server isn't sending intermediate certificates, so some clients trust it and others don't
- Mixed content — the cert itself is fine, but the page loads HTTP resources over an HTTPS connection
Try it on code.live
code.live's SSL Certificate Checker inspects a live domain's certificate chain, expiry, issuer, and SAN list in one request, so you can tell which of the five you're actually dealing with in seconds.
Key takeaways
- Apply one concrete change from this post before collecting more reading.
- Prefer browser-side tools when the work involves secrets, tokens, or PII.
- Document the why next to the how so the next reviewer inherits context.
FAQ
- Who is this guide on ssl for?
- Working developers who need a practical take on ssl certificate errors: the five you'll actually hit — not a marketing overview. Skim the sections, apply one tip, then come back when you hit an edge case.
- Do I need an account to use the related tools?
- No. code.live tools run in your browser with no signup. Nothing you paste is uploaded to a server for the client-side utilities linked from this post.
- How often is this article updated?
- This post was published August 19, 2026. Fundamentals stay stable; check linked tool pages and official docs when version-specific behavior matters.