Buzz
An SSL certificate (SSL certificate) is used on millions of websites to provide security for online transactions. However, during SSL deployment, some issues may arise, and users may encounter error messages on the website they are accessing.
SSL Connection Error
SSL Connection Error occurs during the process when you try to connect to an SSL-enabled website, and your browser (client) cannot establish a secure connection with the website's server.
Depending on the cause of the SSL connection error, the browser may display warnings such as “This Connection is Untrusted”, “The site's security certificate is not trusted”, or “Your Connection is not private”.
Here, Mytour will guide you on how to fix the SSL connection error.
Fixing The SSL certificate for this website is not trusted Error
Internet browsers will display an error message stating that the website's certificate is not trusted if that certificate has not been registered by a reputable Certificate Authority (CA). To have the browser accept the certificate, it must be associated with a 'trusted root certificate'.
Trusted root certificates are embedded in popular browsers such as Internet Explorer, Firefox, Chrome, and Comodo Dragon. These root certificates serve as 'trust tools' to verify the validity of all encountered website certificates. If a certificate is encountered that is not signed by one of these root certificates, the browser will indicate it as untrusted, and the visitor will receive the aforementioned error message.
Most trusted root certificates in browsers are recognized by Certificate Authorities (CAs). When a CA certifies a website, the website's certificate is linked to one of their trusted root certificates in the browser's certificate store.
For security reasons, most Certificate Authorities (CAs) do not directly issue end-entity certificates from root certificates. Instead, they use Intermediate certificates to create a 'chain of trust' in the root certificates. In this system, the root certificate signs the Intermediate certificate, and the Intermediate certificate is used to sign certificates for individual websites.
Therefore, the 'Untrusted' error often occurs due to one of the following two reasons:
- The website is using a Self-Signed Certificate
In many cases, the 'Untrusted' error arises because the website is using a Self-Signed Certificate. As the name suggests, a self-signed certificate is a certificate created and signed by the website owner using web server software. Consequently, this certificate is not associated with any trusted root certificates in the browser's certificate store, leading to the 'Untrusted' error.
Self-signed certificates have several advantages. Firstly, they are free to create and work reasonably well on internal servers. However, it's not advisable to deploy these certificates on commercial websites.
- Intermediate Certificate Not Installed
Another underlying cause of the 'Untrusted' error is that the website's admin has not correctly installed all intermediate certificates on their web server. Here's an illustrative example of this error:
In the diagram, you can see the certificate for www.comodo.com. The Certification Path tab displays the trust chain that the Internet browser uses to verify the certificate. A trusted root certificate signs the intermediate certificate, and then the intermediate certificate signs the website certificate (in this example, www.comodo.com).
When a visitor connects to www.comodo.com, the web server must present both the website certificate and the intermediate certificate to the visitor's browser. The browser then checks all certificates in the trust chain against the root certificates.
Most Certificate Authorities (CAs) will send a CA bundle file containing all required intermediate certificates along with the end-entity certificate to the website owner. However, if the web server admin fails to install all intermediate certificates, users will receive a 'certificate not trusted' error message.
Certificate Name Mismatch Error
The 'Certificate Name Mismatch' error occurs when the server presents a domain name listed on the SSL certificate that does not match the domain name the browser is connecting to. To initiate an HTTPS session, the domain name on the certificate must exactly match the domain name in the browser's address bar.
Below are some reasons for this error:
- The accessed website/server uses an internal server name or IP address, but the certificate is issued only for the Fully Qualified Domain Name (FQDN) (such as www.domain.com). Accessing the server using the internal server name or IP address may lead you to the same website, but if the certificate only contains the FQDN, it can cause a 'Certificate Name Mismatch' error.
- The certificate is issued for domain.com, but the browser's address bar contains www.domain.com (essentially, www is just a subdomain of domain.com). The 'Certificate Name Mismatch' error can still occur but is less common because most major Certificate Authorities, including Comodo, issue single-domain certificates covering both domain.com and www.domain.com.
However, if faced with the 'Certificate Name Mismatch' error, this could be the cause. Using a Wildcard certificate can help you overcome this SSL connection error as all subdomains of domain.com will automatically be protected.
- The Certificate Name Mismatch error can occur when multiple websites are hosted on the same IP address. This often happens in shared hosting environments. In a standard HTTP connection, the browser informs the server which domain it wants to connect to via the host header.
However, when an HTTPS connection is established, engaging with SSL means the browser requests a certificate from the server before presenting the host header. As a result, the server lacks the necessary information to decide which certificate to send and may present the wrong certificate.
If there is only one website and one certificate on an IP address, the cause of the error does not lie here. However, if multiple websites are hosted on the same IP address, the server may provide a certificate for the wrong domain. To prevent this, users can use a Multi-Domain certificate, allowing the website owner to add all websites and server names to the Subject Alternative Name (SAN) field of the certificate.
Mixed Content Error
For a secure connection, HTTPS is established, and all items on the page must be fetched from a secure source. This means all images, videos, iframes, flash movies, and JavaScripts must be fetched from a secure source. If any item is not fetched from a secure source, visitors to the website will receive an error message similar to the one below:
If the visitor selects Yes, all items will be displayed, but the connection will revert to an insecure HTTP connection. If No is chosen, only secure items will be displayed. This means certain videos and images may not be displayed, or the page may not execute crucial scripts. Either way, this sends a negative signal to your website visitors.
Here's how website admins can address the SSL connection error Mixed Content:
- Avoid calling any insecure content via HTTP or port 80. Change all references from HTTP to HTTPS. Ensure that you have set up SSL on the source location. If using sub-domains to store your website's elements, a Wildcard certificate might be beneficial for you.
- Use relative links on your website instead of absolute links. For example, instead of using src=http://mydomain.com/my-script.js, you can use scr=/my-script.js. If your homepage is accessed via HTTPS, the browser will load /my-script.js via HTTPS. This technique is also useful if your website references external content served via HTTP (e.g., YouTube or Google Analytics).
- Implementing SSL across your entire website. This ensures better security for your website visitors and is also a criterion Google uses to rank website rankings, somewhat improving SEO.
Note that implementing SSL across your entire website means you have two copies of content, so you'll have to 'tell' search engines which version is authoritative. To do this:
+ Inform search engines about the authoritative HTTPS version by updating links to point to the HTTPS version. Update your XML sitemap to reference the HTTPS version of your content. Making these changes means search engines will index the SSL version of your website and display this version in search engine results.
+ Ensure robots.txt is available on HTTPS.
+ Redirect all HTTP requests to the HTTPS version using a permanent 301 redirect. This means your search engine page ranking will be transferred to the HTTPS version.
+ Update webmaster tools to reference the HTTPS version of your website instead of HTTP.
Above, Mytour has introduced and guided you through some ways to fix SSL connection errors. If you're facing SSL connection errors, readers can apply one of these methods to fix the issue.
In addition to common SSL errors, when accessing popular websites like Facebook, Gmail, you may also encounter this situation. In this case, the SSL error fixes when accessing Facebook, Gmail that Mytour can help you reconnect.
If you have any questions that need answering, feel free to leave your comments below the post!
