Practical guide · verified against the real thing
SSL certificate errors: what each warning is actually telling you
In one line: Expired, wrong-name, self-signed and mixed content — the four certificate failures, what causes them, and which ones you must never click through.
A certificate error is your browser reporting that the padlock's promise failed — the cryptographic proof that you are talking to the real server, unmodified. The warnings look scary because they should: two of the four causes below are harmless-server-misconfiguration, and two are indistinguishable from an attack without more evidence. The skill is knowing which is which.
The four failures
Expired certificate. The most common, and the server's fault, not yours: certificates expire on a schedule (the current maximum lifetime is 398 days) and whoever runs the site let the renewal lapse. The connection is still encrypted; the identity proof is stale. For a site you trust: stop, don't enter credentials, and report it — a big site with an expired cert is a site with broken maintenance, or something worse wearing that costume. Name mismatch. The certificate is real but belongs to a different name — www. missing from the list, or a subdomain served under the parent's cert. Usually a server misconfiguration; on sites you didn't seek out, name mismatch is also how naive phishing imitates real ones. Self-signed or unknown issuer. Nobody vouches for the server. Normal and intentional on internal company tools and local dev machines; on a public site, a serious signal — the HTTPS explainer covers why the issuer chain is the whole point. Mixed content (usually a shield icon, not a full-page block): the page is HTTPS but loads scripts or images over plain HTTP, which quietly reopens the hole the padlock closed — a site-owner bug, worth reporting.
Quick checks before you conclude anything
Is it one site or all sites? (All sites: your device's clock is the classic culprit — certificates are date-sensitive documents, and a wrong system clock makes every valid cert look expired.) Does the warning survive a fresh browser profile and another network? (If not, suspect your layer — extension, proxy, captive portal — before blaming the site, the browser triage applies.) Click the padlock/warning details: modern browsers name the exact failure — expired, name mismatch, untrusted issuer — and that name is the diagnosis.
The rule about clicking through
"Proceed anyway" exists for one legitimate case: sites you administer or a local development machine where you know exactly why the certificate is self-made. On a banking site, a login page, a payment page — never. The cost of a false alarm is one missed page load; the cost of a real interception is everything the padlock was invented to protect. Site owners on the other side of this table: the fix ladder lives in the domain-connection order — certificates fail most often at the issuer-verification step, not the encryption itself.
Next