A certificate warning means the browser cannot prove that the encrypted connection belongs to the requested domain. Continuing may expose credentials to an intermediary or simply reach a misconfigured server; the browser cannot safely decide which.
Stop for sensitive services
Do not continue to banking, email, healthcare, administration or payment pages. Check the address, device date and another trusted network. Never install a certificate supplied by an unexpected page.
Common legitimate causes
- Expired or incomplete server certificate
- Incorrect device clock
- Hotel captive portal intercepting the first request
- Authorized inspection on a managed workplace device
Captive portals are a special case
Hotel and airport networks may redirect an initial request to a sign-in page. Open a plain, non-sensitive connectivity-check page supplied by the operating system, complete the portal, then return to the intended HTTPS site in a new tab. Never enter the destination site's credentials into the portal.
Use the error type to narrow the cause
An expired certificate, hostname mismatch, untrusted issuer and revoked certificate describe different failures. Check the complete address, device clock and whether the warning occurs on another trusted connection. Do not install a certificate offered by an unexpected page or disable validation to finish a sensitive task.
Site owners must test the public edge
Verify the certificate served by the CDN, load balancer or reverse proxy from outside the hosting network. Check hostname coverage, intermediate certificates, redirect behavior and automated renewal. Testing only the file installed on the origin can miss the certificate visitors actually receive.
Monitor expiry with enough time to repair failed automation and test every public hostname. If a certificate warning affects an account or payment route, pause the journey and publish a factual status update. Telling users to click through teaches exactly the wrong security habit.
A successful HTTPS connection verifies the connection to the named site, not the honesty or safety of its content.