Use a certificate from a publicly trusted authority on nginx
Why it matters
The certificate was issued by an authority that browsers and operating systems do not trust, so visitors see a security warning. This happens with private company CAs, distrusted CAs and certificates issued by a test environment.
The fix
- If you used certbot with --staging, rerun it without that flag to get a real certificate, then reload nginx.
bash
sudo certbot --nginx -d example.com --force-renewal sudo nginx -t && sudo systemctl reload nginx
The examples use example.com. Replace it with your own domain.
Related
- Reported by the certificate chain and expiry check
- Renew the expired TLS certificate
- Fix a certificate that is not valid yet
- Renew the certificate before it expires
- Install a certificate that covers this hostname
- Replace the self-signed certificate with a trusted one
- Serve the full certificate chain
- Replace the expired intermediate certificate
- Re-issue the certificate with a stronger key
- Replace the certificate that uses a broken hash
- Fix the certificate that browsers reject
Scan your domain to see whether this applies to you.