How to Fix Nginx SSL Certificate Not Trusted Error

In this tutorial, you'll learn about How to Fix Nginx SSL Certificate Not Trusted Error. We cover key concepts, practical examples, and best practices.

The Problem

Visitors see NET::ERR_CERT_AUTHORITY_INVALID or SSL certificate not trusted in their browser. SSL/TLS testing tools show unable to verify the first certificate. The server is not sending the full certificate chain. When a browser tries to verify the certificate, it can't find the intermediate CA that links your server certificate to the trusted root.

Quick Fix

1. Check your SSL configuration

sudo cat /etc/nginx/sites-available/example.com | grep -E "ssl_certificate|ssl_certificate_key"

2. Verify the certificate chain

openssl s_client -connect localhost:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer -subject

If the issuer is the root CA (instead of an intermediate), your certificate chain is incomplete.

3. Combine certificates into a fullchain

cat /etc/ssl/certs/example.com.crt \
    /etc/ssl/certs/intermediate.crt \
    > /etc/ssl/certs/example.com.fullchain.crt

4. Update Nginx to use the fullchain

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/ssl/certs/example.com.fullchain.crt;
    ssl_certificate_key /etc/ssl/certs/example.com.key;
}

5. Reload and verify

sudo nginx -t
sudo systemctl reload nginx

6. Test with SSL Labs or openssl

openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | grep -E "return code|verify error"

Expected output:

verify return code: 0 (ok)

7. Use Let's Encrypt / Certbot files

ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

The fullchain.pem file from Certbot already includes the intermediate.

8. Check certificate expiry

echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

Common Causes

Test Configuration Changes First

sudo nginx -t
# nginx: the configuration file syntax is ok
# nginx: configuration file test is successful
sudo systemctl reload nginx

Always run nginx -t before reloading the configuration. This validates syntax, checks file paths, and verifies that SSL certificates are accessible before applying changes.

Prevention

• Always configure ssl_certificate with the fullchain file, not just the server certificate
• Use openssl s_client to verify your configuration after any SSL change
• Automate renewal with Certbot and use its provided fullchain.pem path
• Set up certificate expiry monitoring to catch expiring certs before they break
• Test the full certificate chain with openssl s_client -connect yourdomain.com:443 -showcerts before updating the Nginx configuration
• Use curl --cacert /path/to/ca-bundle.crt https://yoursite.com to test from the client side and isolate SSL issues