SSL certificate not trusted? Fixing chain, hostname and expiry errors
6 min read · Published · Password and DNS Toolbox
Short answer
Run the host through an SSL checker. The three usual causes are a missing intermediate certificate (install the full chain), a certificate that does not list the host name you use (reissue it with that name), and an expired certificate (renew it and automate renewal — lifetimes are shrinking to 47 days by 2029).
Key points
- Always serve the full chain (leaf + intermediates).
- Wildcards cover one level only: *.example.com does not cover example.com.
- Maximum lifetime: 200 days since 15 March 2026, 100 days from 15 March 2027, 47 days from 15 March 2029.
Missing intermediate certificate
Your certificate is signed by an intermediate CA, which is signed by a root in the browser's trust store. The server must send the intermediate. Browsers can often fetch or cache it, so the site "works for me" — but apps, APIs, mail clients and older devices fail. Fix: configure the server with the full-chain file (with Let's Encrypt, fullchain.pem).
Hostname mismatch
The name you type must appear in the certificate's Subject Alternative Names. Common traps: a certificate for www.example.com used on example.com; a wildcard *.example.com expected to cover a.b.example.com. Reissue the certificate including every name you serve, and use the redirect checker to make sure visitors land on a covered name.
Expired or soon-expiring certificates
Under CA/Browser Forum ballot SC-081, maximum certificate lifetimes are shrinking:
| Issued from | Maximum validity |
|---|---|
| 15 March 2026 | 200 days |
| 15 March 2027 | 100 days |
| 15 March 2029 | 47 days |
Manual renewal will not keep up. Use ACME automation (Let's Encrypt, or your host's AutoSSL) and monitor expiry with the SSL checker.
Other causes
- Self-signed certificate — fine for internal testing, never for public sites.
- Old protocols — servers still offering only TLS 1.0/1.1 fail in modern clients; enable TLS 1.2 and 1.3.
- Mail servers — IMAP, POP3 and SMTP submission need valid certificates too; check
host:993,host:995orhost:465. For inbound mail, consider MTA-STS.
After fixing TLS, review your security headers, especially HSTS.
Frequently asked questions
Why does my site work in Chrome but fail in an app?
Almost always a missing intermediate certificate. Browsers compensate; many apps do not.
Does a wildcard cover the bare domain?
No. *.example.com covers www.example.com but not example.com; include both names.
How often will I need to renew?
At most every 200 days now, every 47 days from 2029. Automate it.