Certificate Management Service:How do I fix certificate errors shown in my browser?

Solutions:

• Clear your browser cache and revisit the website.

• Verify that the domain bound to the SSL certificate matches the domain you are accessing.

  Option A: Check in the Certificate Management Service console

  • Log in to the Certificate Management Service console.

  • In the navigation pane on the left, choose Certificate Management > SSL Certificate Management.

  • On the SSL Certificate Management page, locate the deployed certificate and verify that the bound domain matches the site domain. If they do not match, upload the correct certificate for the domain.

  Option B: Check in the browser

  • Visit the website domain and click the padlock icon in the browser address bar.

  • Click Certificate is not valid.

  • In the certificate details, verify that the Common Name (CN) matches the website domain.

• Check whether the SSL certificate has expired.

  SSL certificates are valid for one year by default. If a "not secure" warning appears after a subsequent deployment, the certificate may have expired. Check the expiration date using one of the following methods.

  Option A: Check in the Certificate Management Service console

  • Log in to the Certificate Management Service console.

  • In the navigation pane on the left, choose Certificate Management > SSL Certificate Management.

  • On the SSL Certificate Management page, locate the deployed certificate and check whether it has expired.

    If the certificate has expired, renew it promptly. For more information, see SSL certificate renewal and expiration.

  Option B: Check in the browser

  • Visit the website domain and click the padlock icon in the browser address bar.

  • Click Certificate is not valid.

  • In the certificate details, check the expiration date.

• Verify that the SSL certificate format is correct.

  Different web servers require different certificate formats. For more information, see Deploy a certificate.

Solutions:

• If you use an Alibaba Cloud Elastic Compute Service (ECS) instance, go to the Security Groups page in the ECS console to open port 443. For detailed steps on configuring security groups, see Add a security group rule.

  Note

  Default ports (HTTP 80, HTTPS 443) do not require a port number in the URL. For non-default ports, use the format http://domain_name:port_number or https://domain_name:port_number.

• Verify that HTTPS port 443 is open. If you use a non-standard port, confirm it is open and not occupied by other services.

• If a firewall is configured, verify that it does not block external access to port 443.

• For non-Alibaba Cloud servers, refer to your provider's security configuration guide to open port 443.

Solutions:

• Enable TLS 1.2 or TLS 1.3 in your web server configuration. Ensure the client supports the configured version. NGINX example:

  server {
      listen 443 ssl;
      server_name yourdomain.com;
  
      # SSL certificate and private key paths
      ssl_certificate /path/to/your_certificate.crt;
      ssl_certificate_key /path/to/your_private.key;
  
      # Set supported SSL/TLS protocol versions
      ssl_protocols TLSv1.2 TLSv1.3;
  
      # Optional: Set more secure cipher suites
      ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
  
      location / {
          root /var/www/html;
          index index.html index.htm;
      }
  }

• Ensure the server cipher suites are compatible with the client OS TLS version. The following steps apply to Windows.

  1. Open Control Panel and click Network and Internet.

  2. In the Network and Internet panel, click Internet Options, and then click the Advanced tab.

  3. Select TLS 1.2 or TLS 1.3 for better security and compatibility.

Solutions:

• Replace HTTP resource URLs with HTTPS so all external resources (images, scripts, stylesheets) load over HTTPS.

• For resources on the same domain, use relative URLs. The browser automatically uses the current page protocol.

• If third-party resources do not support HTTPS, remove the HTTP references, redeploy, and verify the website.