Certificate Management Service:Troubleshoot certificate deployment issues based on browser error messages

Clear browser cache

Clear your browser cache and reload the page. If the error persists, proceed to the next solutions.

Verify certificate-domain match

Option A: Check in the Certificate Management Service console

1. Log on to the Certificate Management Service console.

2. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management.

3. Locate your certificate and verify that the bound domain matches the domain in your browser address bar. If the domain names do not match, upload the correct certificate.

Option B: Check in the browser

1. Click the Certificate is not valid link or the padlock icon in the address bar.

2. View the certificate details. Confirm that the Common Name (CN) field matches the domain you are accessing.

Check certificate expiration

Option A: Check in the Certificate Management Service console

1. Log on to the Certificate Management Service console.

2. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management.

3. Locate your certificate and check the expiration date.

If the certificate has expired, renew it. For more information, see Renew an SSL certificate and handle expiration.

Option B: Check in the browser

Click the padlock icon or the Certificate is not valid link in the address bar. The certificate details show the validity period.

Check the certificate format

Different web servers support different certificate formats. Deploy the correct format for your web server. For more information, see Deploy an SSL certificate.

Check certificate paths in the configuration file

Verify that the certificate and private key paths in your web server configuration file point to the correct files.

Example NGINX configuration:

server {
    listen 443 ssl;
    server_name example.com;
    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;
}

Confirm that /etc/nginx/ssl/example.com.crt and /etc/nginx/ssl/example.com.key exist and contain valid content.

Redeploy the certificate

If you recently renewed or reissued your certificate, redeploy it to the server. Then restart the web server to load the new certificate.

For cloud server deployment, see Deploy an SSL certificate to an Elastic Compute Service (ECS) instance or a Simple Application Server.

Open port 443

HTTPS uses port 443 by default. HTTP uses port 80. If you use a non-default port, the URL must follow the format https://domain_name:port_number.

For Elastic Compute Service (ECS) instances:

1. Log on to the Security Groups page in the ECS console.

2. Locate the security group associated with your instance.

3. Add an inbound rule that allows TCP traffic on port 443.

For detailed steps, see Add a security group rule.

For other servers:

Check your firewall settings and ensure port 443 is open for inbound TCP traffic.

Check web server configuration

Verify that your web server configuration file includes the correct HTTPS settings. For NGINX, the configuration must include the listen 443 ssl; directive and valid certificate paths.

server {
    listen 443 ssl;
    server_name example.com;
    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;
}

After updating the configuration, restart the web server.

Verify the certificate

1. Log on to the Certificate Management Service console.

2. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management.

3. Verify that the certificate status is valid and correctly issued.

If the certificate has expired, renew it. For more information, see Renew an SSL certificate and handle expiration.

Check DNS resolution

Run the following commands to verify that your domain resolves to the correct server IP address:

ping your_domain
nslookup your_domain

If the domain does not resolve correctly:

• Check your DNS records in your domain registrar's control panel.

• If you use Content Delivery Network (CDN), verify the CDN settings and ensure the origin server address is correct.

Configure TLS 1.2 and TLS 1.3 on the web server

Disable insecure protocols and enable only TLS 1.2 and TLS 1.3.

NGINX configuration example:

server {
    listen 443 ssl;
    server_name example.com;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;

    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;
}

After updating the configuration, restart NGINX.

Update TLS settings on the client operating system

If the error appears only on specific client machines, the operating system may not support the required TLS version.

Windows example:

1. Open Control Panel > Network and Internet > Internet Options.

2. Click the Advanced tab.

3. Under the Security section, select Use TLS 1.2 and Use TLS 1.3 (if available).

4. Clear the checkboxes for Use SSL 2.0, Use SSL 3.0, Use TLS 1.0, and Use TLS 1.1.

5. Click OK and restart the browser.

Update HTTP resource URLs to HTTPS

Search your website source code for all http:// resource references and replace them with https://.

Before:

<img src="http://example.com/image.png" />
<script src="http://example.com/script.js"></script>

After:

<img src="https://example.com/image.png" />
<script src="https://example.com/script.js"></script>

Use relative URLs for same-domain resources

For resources hosted on the same domain, use protocol-relative or path-relative URLs.

Protocol-relative URL:

<img src="//example.com/image.png" />

Path-relative URL:

<img src="/images/image.png" />

Check third-party resources

For resources loaded from third-party domains:

1. Verify that the third-party service supports HTTPS. If it does, update the URL to use https://.

2. If the third-party service does not support HTTPS, host the resource on your own server or find an alternative provider that supports HTTPS.

3. Remove any unnecessary third-party HTTP references.