SSL Certificate Errors and "Not Secure" Warnings: Fixes
An SSL certificate lets a browser open your website over an encrypted connection, shown as a padlock. A warning means the browser found a problem with that certificate, or found no certificate at all. On Noiz hosting the fix is usually the same: reissue the free Let's Encrypt certificate in Plesk, cover every name your visitors use, and make sure the domain points at your hosting.
Last reviewed: 11 November 2026, against Plesk Obsidian on Noiz hosting.
Before you start
- Access to Plesk. How to log in to Plesk shows the single sign-on link from the console.
- The exact wording of the warning, or a screenshot. It tells you which fix to use.
- The domain points at Noiz hosting. A certificate can only be issued for a name that points at the server. How to point your domain to Noiz hosting covers it.
What do SSL and TLS mean?
SSL (Secure Sockets Layer) is the old name, and TLS (Transport Layer Security) is the protocol in use today. People say SSL for both. A certificate proves your website is yours and lets the browser and your server agree an encryption key. Without it, anyone on the path between your visitor and your server can read and change what passes. Let's Encrypt issues certificates for free, and every Noiz shared plan includes one.
What does the warning mean?
| What you see | What it means | Fix |
|---|---|---|
| "Your connection is not private", NET::ERR_CERT_DATE_INVALID | The certificate has expired, or the visitor's device clock is wrong | Renew the certificate. If only one device is affected, correct its date and time |
| NET::ERR_CERT_COMMON_NAME_INVALID, or SSL_ERROR_BAD_CERT_DOMAIN in Firefox | The certificate does not cover the name in the address bar, often www or a subdomain |
Reissue the certificate with every name selected |
| NET::ERR_CERT_AUTHORITY_INVALID | The browser does not trust the certificate, often because the server is showing its default one | Point the domain at your hosting and install the certificate there |
"Not secure" in the address bar on an http:// address |
There is no HTTPS, or visitors reach the HTTP address | Install a certificate, then turn on the HTTP to HTTPS redirect |
| A padlock with a warning, or "Not fully secure" | The page is secure, but some images or scripts on it are not | Fix mixed content |
| ERR_TOO_MANY_REDIRECTS after turning on HTTPS | Two redirect rules fight each other | Keep one HTTPS redirect, in Plesk or in the website, not both |
Google has announced that Chrome 154, in October 2026, asks visitors for permission before opening a public site without HTTPS, so an HTTPS-only site is now the safe default.
How do you check the certificate?
- In the browser, select the warning or the padlock, then the certificate details. They show the names it covers and its expiry date.
- In the console, open Domains > My Domains, then the domain. The SSL Certificates block shows the SSL status and the start and expiry dates.
- On the command line, on macOS or Linux, replace
yourdomain.comand run:
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates
How do you fix it in Plesk?
- Open Plesk, then Websites & Domains, then your domain's SSL/TLS Certificates.
- Select Install for the free certificate from Let's Encrypt.
- Tick the names your visitors use: the main domain, and the www name. Add webmail if mail clients connect to it.
- Select Get it free and wait for Plesk to confirm.
- Test the site over HTTPS in a private window.
- Turn on Redirect from http to https once HTTPS works, then test the HTTP address.
How to install a free Let's Encrypt SSL certificate in Plesk covers each option, including wildcard certificates and HSTS.
Why did renewal stop working?
Plesk renews the certificate automatically 30 days before it expires. It fails when the check Let's Encrypt makes cannot reach your site:
- The domain no longer points at Noiz hosting, after a DNS or nameserver change.
- A wrong IPv6 (AAAA) record sends the check to a server that does not answer.
- A redirect or password protection blocks the
/.well-known/acme-challenge/path. - A CAA record names another certificate authority.
DNS records explained shows how to read A, AAAA and CAA records. Let's Encrypt is moving to shorter certificate lifetimes, 64 days from 10 February 2027 and 45 days by 2028, so automatic renewal and healthy DNS matter more every year.
Troubleshooting
| Symptom | Fix |
|---|---|
| The certificate is new but the warning stays | Clear the browser cache, or test in a private window |
| It works on your phone but not your computer | Check the computer's date and time, and its system updates |
The www name warns, the bare name works |
Reissue with the www name ticked |
| Plesk shows a Let's Encrypt error | Use the exact error to check the DNS answer for that name |
Need a hand?
Open a ticket in the console with the domain, the exact warning and the error Plesk shows. Never send a private key. Your SSL certificate is free with your hosting, and we will help you keep it renewed.
Official Documentation Reference
- Securing connections with the SSL It! extension (Plesk): certificate options.
- Let's Encrypt: Decreasing certificate lifetimes to 45 days: the timeline for shorter certificates.
- Google: HTTPS by default: what Chrome 154 changes.
