Your connection is not private (expired certificate)

Chrome’s “Your connection is not private” on a known site usually means the certificate failed validation, often because it expired.

The interstitial is generic on purpose: users should not need to parse PKIX errors. When the site worked yesterday, expiry on the leaf or a broken renewal that left an old cert in place is the leading explanation.

Less common causes include captive portals and corporate TLS inspection, but those usually affect many sites at once. A single-domain error warrants checking notAfter on the server certificate first.

First response

Your connection is not private usually means the certificate is expired or untrusted. Confirm notAfter from outside the network and install a valid renewed chain on the listener.

Search interest in your connection is not private expired rises when the leaf notAfter on the hostname customers type is already in the past. Clients cannot rewrite server certificate dates; they only accept chains that pass PKIX checks at handshake time.

For Your connection is not private (expired certificate), prove the failure from outside your office VPN before you change application code, purge caches, or ask end users to reboot. Capture the broken serial number and notAfter, renew on the listener that actually terminates that name, reload every node in the path, then re-run the same OpenSSL and browser checks that opened the incident.

Escalations for connection-not-private-expired-certificate should cite fresh openssl -dates on the live hostname from outside VPN output before anyone edits client code or blames Wi‑Fi. Your connection is not private usually means the certificate is expired or untrusted. Confirm notAfter from outside the network and install a valid renewed chain on the listener. When full-page blocks on expired leaf material clusters around Chrome Your connection is not private pages, the expired material is usually bound to the certificate presented after SNI selection instead of a mysterious platform bug. Executive summaries need the public hostname and current notAfter, not screenshots from a VPN-split test laptop.

See also Android SSL certificate expired errors and Certificate chain incomplete in the browser.

What this error means

Chromium maps several TLS failures into the same privacy warning. Expired certificates are among the most common in operations because they have predictable deadlines teams sometimes miss.

The warning appears before any page content loads, so marketing tags and error pages never run. From the user’s perspective the business is offline.

Restore service by issuing a new publicly trusted certificate, serving the full chain on the listener that answers public DNS, and verifying from an off-network vantage.

In PKIX terms, Chrome Your connection is not private pages treat the TLS Certificate message as authoritative: signatures must verify, each link must be within notBefore/notAfter, and only then does name matching run against CN and SAN. When the leaf expired, full-page blocks on expired leaf material is expected even if the issuer is publicly trusted. Guides titled connection not private expired certificate still require reading dates on every certificate the server sends, including forgotten cross-sign intermediates.

Triage for connection not private expired certificate should reject quick myths: flushing DNS or rebooting laptops does not move server notAfter forward. It is not proof the whole internet is broken when other HTTPS sites load for Chrome Your connection is not private pages. It is not interchangeable with registrar billing lapses unless revalidation fails later. It is not fixed by turning off TLS at the load balancer while marketing keeps publishing https:// links. Validated externally, openssl -dates on the live hostname from outside VPN must show fresh dates on the certificate presented after SNI selection before you close the incident.

Common causes

These patterns appear often during your connection is not private expired incidents. They are not exhaustive, but they explain why renewal looked finished internally while strangers still received expired material.

Runbooks for connection not private expired certificate most often break at handoff: certbot or a vendor portal issued new certs, but the certificate presented after SNI selection never received a reload. Teams tracked PEM files in git while production continued serving the previous listener binding. OV renewals waited on legal approvers until full-page blocks on expired leaf material became customer-visible. Inventory spreadsheets omitted the hostname that Chrome Your connection is not private pages actually call during peak traffic.

Architecture amplifies connection not private expired certificate: multiple regions, canary pools, or blue/green deploys can leave one ASG member presenting yesterday's fullchain. Shared IP default certificates silently terminate vanity hostnames without dedicated SNI rules. Mounted TLS secrets updated on disk while Envoy or nginx workers kept the old chain until signaled. Your connection is not private usually means the certificate is expired or untrusted becomes harder to debug when only a fraction of Chrome Your connection is not private pages hit the stale anycast node.

Measurement gaps complete the story for connection not private expired certificate. Synthetic monitors that disable certificate verification greenlit deploys that fail for real Chrome Your connection is not private pages. Redirect maps hid which hop expired until operators ran openssl -dates on the live hostname from outside VPN per hostname. Dashboards celebrated TCP uptime while notAfter crossed midnight UTC without a page. Post-mortems should ask whether CT logs or stapled OCSP would have warned days earlier.

Confirm from the outside

OpenSSL

echo | openssl s_client -connect HOST:443 -servername HOST 2>/dev/null | openssl x509 -noout -dates -subject -issuer

External OpenSSL should show notAfter in the past when expiry drives the interstitial.

How to read the output

Start with openssl -dates on the live hostname from outside VPN against the live customer hostname, capturing the leaf presented after SNI selection. Interpret notBefore= and notAfter= first: past notAfter guarantees failure for full-page blocks on expired leaf material regardless of pretty issuer branding. Next read subject= and any X509v3 Subject Alternative Name extension for alignment with the URL bar. Finally note issuer= so you know whether renewal changed intermediates; record serial numbers in the ticket for post-deploy diffing.

curl

curl -vI --connect-timeout 10 https://HOST/ 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

curl typically reports certificate has expired in parallel with the browser warning for the same URL.

Browser spot-check

Clicking Not secure details on the error page (when available) shows certificate dates; compare to OpenSSL.

Fix checklist

Work this list in order for your connection is not private (expired certificate). Each step should produce evidence (command output, timestamps, serial numbers) you can paste into the incident ticket.

1. Reproduce from home or mobile data to rule out corporate proxy artifacts.
2. Capture served cert dates with OpenSSL and SNI matching the public hostname.
3. Locate active cert on load balancer or CDN versus disk on origin.
4. Renew with correct names and full intermediate chain.
5. Reload all terminators in the DNS target path.
6. Clear CDN edge if it still serves an old custom cert slot.
7. Verify browser loads without interstitial externally.
8. Document which listener had the expired material for runbooks.

Roll out and verify

Procurement for connection not private expired certificate begins with a reissue that lists every hostname Chrome Your connection is not private pages need, including forgotten admin and callback URLs. Validate CSR/key pairs, download CA bundles, and schedule work on the certificate presented after SNI selection during a staffed change window. If automation handles ACME, prove challenges use the same DNS names customers resolve publicly, not internal-only labels.

Installation for connection not private expired certificate means concatenating leaf and required intermediates the way your stack documents, then touching every node that terminates the name. Reload web servers, recycle ingress pods, or update cloud listener objects so data planes read new bytes. For load balancers, sync default and per-host certificates so SNI cannot fall back to expired defaults. Repeat openssl -dates on the live hostname from outside VPN until fingerprints or serials change everywhere responders tested earlier.

Verification for connection not private expired certificate must mimic strangers: external synthetics, mobile carriers, and CI jobs without corporate trust roots. Confirm full-page blocks on expired leaf material disappeared for Chrome Your connection is not private pages on flows heavier than GET /. Restore any strict TLS, HSTS, or CDN SSL modes relaxed during firefighting. Feed the hostname into continuous notAfter monitoring with thresholds well before the next CA-enforced renewal cliff.

What to automate

Certificate files on disk lie. Automate live TLS checks on the exact hostname and port users hit, including redirects and the certificate presented after TLS terminates on a load balancer or CDN. Pair certificate notAfter with RDAP domain registration expiry so re-validation is not blocked by a lapsed registrar.

Page on-call when consumer Chrome interstitial detectors fail twice. Schedule alerts at 30, 14, 7, and 1 day before expiry so on-call has runway for ACME failures, manual OV revalidation, or change windows. Services such as ssldays can run external checks and renewal reminders without replacing your CA workflow.