A certificate warning means the browser cannot prove that the encrypted connection belongs to the requested domain. Continuing may expose credentials to an intermediary or simply reach a misconfigured server; the browser cannot safely decide which.
Stop for sensitive services
Do not continue to banking, email, healthcare, administration or payment pages. Check the address, device date and another trusted network. Never install a certificate supplied by an unexpected page.
Common legitimate causes
- Expired or incomplete server certificate
- Incorrect device clock
- Hotel captive portal intercepting the first request
- Authorized inspection on a managed workplace device
For site owners
Test the complete certificate chain, hostname coverage and renewal automation. Fix the server; do not tell visitors to ignore the warning.
A padlock is meaningful only when certificate validation succeeds. Treat the warning as a failed security check, not as an inconvenient design choice.
Captive portals are a special case
Hotel and airport networks may redirect an initial request to a sign-in page. Open a plain, non-sensitive connectivity-check page supplied by the operating system, complete the portal, then return to the intended HTTPS site in a new tab. Never enter the destination site's credentials into the portal.
Compare, do not override
If the warning occurs on one device only, inspect its clock, antivirus interception and installed certificates. If it appears everywhere, notify the site owner. The diagnosis changes; the safe rule—no sensitive data through a failed certificate—does not.
Read the exact warning before troubleshooting
An expired certificate, name mismatch, untrusted issuer and interception warning describe different failures. Check the device clock, intended hostname and whether the problem occurs on another trusted connection. Do not install a certificate supplied by an unfamiliar pop-up or network operator merely to make the page open.
Site owners need an external test
Verify the complete certificate chain, host coverage, renewal automation and redirects from outside the hosting network. Monitor expiry well before the final day and test every public hostname, not only the homepage. A valid certificate on the origin does not help if a CDN or load balancer serves another one.
Certificate warnings protect the identity of the encrypted connection. Proceeding can send credentials to an impostor or through an unexpected interceptor, so sensitive work should wait until the cause is understood.
Sources and further reading
Use the right privacy tool for the task
A browser proxy changes the network path for one session. Review the Privacy Policy and use a trusted direct connection for sensitive accounts.