The keytool utility shipped with the Java Development Kit (JDK) creates a key pair inside a Java keystore and turns it into a CSR (Certificate Signing Request), the encoded block a Certificate Authority (CA) reads to identify you before it issues a certificate. For code signing, what keytool may legitimately be used for changed on […]
A code signing certificate proves who published a piece of software and shows that the code has not been changed since it was signed. To order one, you create a CSR (Certificate Signing Request), the block of encoded text the Certificate Authority (CA) uses to identify you and issue the certificate. Code signing CSRs follow […]
NET::ERR_CERT_SYMANTEC_LEGACY is a Chrome certificate error from a very specific moment in web history. It marked a certificate that traced back to Symantec’s old certificate authority, the infrastructure behind the Symantec, Thawte, GeoTrust, RapidSSL, VeriSign and Equifax brands, which Google removed from Chrome’s trust in 2018. That story is finished, and so is the error […]
Most browser certificate warnings mean something was configured wrong. NET::ERR_CERT_REVOKED is different. It means the certificate was issued correctly, was accepted as genuine, and then the Certificate Authority that issued it deliberately cancelled it before its expiry date. Nothing is broken in the sense of a typo in a config file. Somebody decided this certificate […]
NET::ERR_CERT_DATE_INVALID is one of the narrowest errors Chrome raises. It is not a verdict on who issued the certificate, on the domain it was issued for, or on the strength of the encryption. It says one thing only: at the moment of the connection, the browser’s clock fell outside the period the certificate is valid […]
When Chrome blocks a page with NET::ERR_CERT_AUTHORITY_INVALID, it is saying something narrower than “the certificate is bad”. The certificate may be perfectly valid: issued by a real Certificate Authority, matching the domain, and still well inside its validity period. What failed is the chain. Chrome could not link that certificate back to a root certificate […]
A modulus mismatch means your SSL certificate and your private key are not a matching pair. The certificate was issued for one key, and the file your server is loading is a different key. Because a TLS server has to prove it holds the private key belonging to the certificate it presents, there is nothing […]
ERR_SSL_VERSION_OR_CIPHER_MISMATCH is the message Chrome shows when it cannot agree on encryption terms with a website. The handshake ends before any page content is sent, so there is nothing to display and no option to continue anyway. You may also encounter variations of this error: That second line is not a paraphrase. It is the […]
If you landed here after searching for ERR_SSL_VERSION_INTERFERENCE, start with the part most guides leave out: Google Chrome does not produce this error anymore, and has not since 2019. The code was retired from the browser, so a current version of Chrome cannot display that message at all. That does not mean the problem behind […]
Chrome shows NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM when a site presents a certificate signed with a hashing algorithm the browser no longer accepts. In practice, that algorithm is SHA-1. The error reads like a server misconfiguration, but it is narrower than that. A signature algorithm is written into a certificate at the moment the Certificate Authority signs it, and […]
