Skip to content

TLS certificate is self-signed or from an untrusted issuer

A TLS (Transport Layer Security) certificate needs to be issued by a certificate authority that browsers recognise and trust, so they can confirm a site is genuinely who it claims to be. This check looks at who actually issued the site's certificate. On this site, the certificate issuer matches a pattern associated with self-signed certificates or default placeholder certificates, rather than a trusted, browser-recognised certificate authority. Browsers show a full-page security warning for self-signed or untrusted certificates, which makes the site effectively unusable for any normal visitor, since almost nobody clicks through a warning telling them a connection isn't secure. This typically points to either a default placeholder certificate that was never replaced after setup, or a misconfigured server. Your developer should replace the certificate with one issued by a trusted certificate authority. Let's Encrypt is a widely used, free option that most hosting platforms and CDNs support setting up directly. This is typically about 30 minutes of work, and can usually be automated to renew itself going forward.

Why this matters

Browsers show a full-page security warning for self-signed or untrusted certificates, which makes the site effectively unusable for any normal visitor, since almost nobody clicks through a warning telling them a connection isn't secure. This typically points to either a default placeholder certificate that was never replaced after setup, or a misconfigured server.

How to fix it

Your developer should replace the certificate with one issued by a trusted certificate authority. Let's Encrypt is a widely used, free option that most hosting platforms and CDNs support setting up directly. This is typically about 30 minutes of work, and can usually be automated to renew itself going forward.