All Products
Search

This Product

    Enterprise Distributed Application Service:"Your connection is not private" error after associating CNKIT with an HTTPS listener

    Document Center

    Enterprise Distributed Application Service:"Your connection is not private" error after associating CNKIT with an HTTPS listener

    Last Updated:Mar 11, 2026

    After you associate Cloud Native Kit (CNKIT) with an HTTPS listener on a Server Load Balancer (SLB) instance, your browser may display a certificate warning:

    • Chrome: Your connection is not private (NET::ERR_CERT_AUTHORITY_INVALID or NET::ERR_CERT_COMMON_NAME_INVALID)

    • Firefox: Warning: Potential Security Risk Ahead (SEC_ERROR_UNKNOWN_ISSUER for self-signed certificates, SSL_ERROR_BAD_CERT_DOMAIN for domain mismatch)

    • Safari: This connection is not private or Safari can't verify the identity of the website

    • Edge: Your connection isn't private

    Causes

    The error occurs when the browser cannot verify the SSL/TLS certificate served by the HTTPS listener. Two common scenarios trigger this warning.

    Self-signed certificate

    If CNKIT uses a self-signed certificate, browsers flag the connection as untrusted because no trusted certificate authority (CA) has signed the certificate. This is expected behavior, not a misconfiguration.

    Certificate-domain mismatch

    If you use a certificate issued by Alibaba Cloud or another CA, the domain name on the certificate must match the URL in the browser. When the certificate's Subject Alternative Name (SAN) does not match the SLB IP address or domain name you are accessing, the browser rejects the certificate.

    For example, a certificate issued for app.example.com does not cover the SLB IP address 192.168.XX.XX or a different domain such as internal.example.net.

    Diagnose the cause

    Before applying a fix, confirm which cause applies to your environment.

    Run the following openssl command to inspect the certificate served by the HTTPS listener:

    openssl s_client -connect <SLB-IP-or-domain>:443 -servername <SLB-IP-or-domain> 2>/dev/null | openssl x509 -noout -issuer -subject -ext subjectAltName

    Replace <SLB-IP-or-domain> with the IP address or domain name of your SLB instance. The -ext subjectAltName flag requires OpenSSL 1.1.1 or later.

    Interpret the output:

    Output patternDiagnosisNext step
    issuer and subject are identicalThe certificate is self-signed.See Solution 1: Replace the self-signed certificate.
    subject or subjectAltName does not contain the domain or IP you are accessingThe certificate does not cover your access URL.See Solution 2: Match the certificate to your access domain.

    Solutions

    Solution 1: Replace the self-signed certificate

    Replace the self-signed certificate with a certificate issued by a trusted CA:

    1. Obtain an SSL/TLS certificate for the domain name you use to access CNKIT. Request a free or paid certificate from Alibaba Cloud Certificate Management Service or another trusted CA.

    2. Make sure the certificate's SAN field covers the domain name you use (for example, cnkit.example.com).

    3. Associate the new certificate with the HTTPS listener on your SLB instance.

    4. Access CNKIT through the domain name that matches the certificate, not through the SLB IP address directly.

    Solution 2: Match the certificate to your access domain

    If you already use a CA-issued certificate but still see the warning:

    1. Verify that the domain name on the certificate matches the URL in your browser address bar.

    2. If you access CNKIT by IP address, do one of the following:

      • Switch to a domain name that matches the certificate.

      • Reissue the certificate with the correct domain name.

    3. If you use a wildcard certificate (for example, *.example.com), verify that your access domain is a single-level subdomain. A wildcard certificate for *.example.com covers app.example.com but does not cover cnkit.app.example.com.

    Workaround: Bypass the warning in Chrome

    If replacing the certificate is not feasible -- for example, in a development or testing environment -- you can bypass the Chrome warning:

    1. Open the page that displays the Your connection is not private error.

    2. Click anywhere on the page to make sure it has focus.

    3. Type thisisunsafe on your keyboard. Do not type this in the address bar -- type it directly on the warning page.

    4. The page refreshes automatically and loads CNKIT.

    This bypass works only in recent versions of Chrome. For other browsers, consult the browser documentation on how to proceed past a self-signed certificate warning. This workaround does not fix the underlying certificate issue and is not recommended for production environments.

    Verify the fix

    After you apply a solution, confirm that the warning is resolved:

    1. Open your browser and navigate to the CNKIT URL.

    2. Verify that no certificate warning appears.

    3. Click the padlock icon in the address bar to confirm the certificate details match your domain and are issued by a trusted CA.