NET::ERR_CERT_INVALID

Common causes

• A self-made certificate is missing required fields, such as a subject alternative name or the serverAuth extended key usage.
• The certificate is badly encoded, often from a home-made script or an old appliance.
• On macOS, a private-CA certificate breaks Apple rules such as the maximum validity period.
• TLS inspection software generates certificates the browser considers invalid.

How to fix it

1. Regenerate the certificate with a subjectAltName for every hostname and extendedKeyUsage = serverAuth.
2. Keep private certificate lifetimes short (825 days or less for Apple platforms, 398 days for public CAs).
3. For local development, use a tool such as mkcert that creates standards-compliant certificates.
4. If it appears on every site, check for antivirus or proxy HTTPS inspection.