NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM
The certificate is signed with an insecure algorithm
Seen in Chrome, Edge (Firefox: SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED)
A certificate in the chain is signed with SHA-1 or MD5, which browsers no longer accept.
Common causes
- An old internal device or appliance (printer, NAS, router, IPMI) still uses a SHA-1 certificate.
- A private CA issues leaf or intermediate certificates signed with SHA-1.
- A legacy intermediate certificate is still included in the served chain.
How to fix it
- Reissue the certificate signed with SHA-256 or stronger, e.g. "openssl req -new -sha256 ...".
- For a private CA, reissue its intermediate and leaf certificates with SHA-256.
- Update the device firmware so it can generate or accept modern certificates.
Got a different message? Paste it into the error explainer.
Related errors
- NET::ERR_CERT_DATE_INVALID · The certificate has expired or is not yet valid
- NET::ERR_CERT_AUTHORITY_INVALID · The certificate isn't issued by a trusted authority
- SEC_ERROR_UNKNOWN_ISSUER · Firefox doesn't recognise the certificate's issuer
- NET::ERR_CERT_COMMON_NAME_INVALID · The certificate doesn't cover this name
- ERR_SSL_PROTOCOL_ERROR · The secure connection failed during the handshake
- ERR_SSL_VERSION_OR_CIPHER_MISMATCH · No TLS version or cipher in common
- You cannot visit this site right now because the website uses HSTS · HSTS blocks the bypass of a certificate error
- NET::ERR_CERT_REVOKED · The certificate has been revoked by its issuer
- NET::ERR_CERT_INVALID · The certificate is malformed or breaks platform rules
- NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED · The certificate is not logged in Certificate Transparency
- ERR_SSL_UNRECOGNIZED_NAME_ALERT · The server has no site configured for this hostname
- ERR_SSL_OBSOLETE_VERSION · The site uses an outdated TLS version