Certificate Authority Not Trusted

What it means

The authority that issued your certificate is not usable as a certificate authority by browsers and operating systems, so the certificate cannot be trusted no matter how it is installed. This differs from a self-signed certificate: the issuer here is a distinct entity, but one that public trust stores don't recognize as a valid CA.

Why it matters

Trust in TLS ultimately traces back to a fixed set of root certificate authorities that ship with browsers and operating systems. A certificate issued by an authority outside that set — a private internal CA, a misconfigured CA certificate, or one that has been removed from trust stores — fails verification the same way an invalid or self-signed certificate does, regardless of how correctly everything else about the installation was done.

What Nivaronix checks

Nivaronix performs a strict TLS handshake with certificate verification enabled and records this finding when OpenSSL specifically reports the issuing CA as invalid for certificate-issuing purposes. This is a certificate-trust check, not a scan for server-side vulnerabilities.

Example evidence

Illustrative example, not a live scan result. Run the checker below to see your own domain's actual status.

Illustrative example only — not a live scan result.

URL: https://example.com
Issuer: CN=Internal Corp CA
OpenSSL verification code: 24 (INVALID_CA)
Status: CERTIFICATE AUTHORITY NOT TRUSTED

How to fix it

• Obtain your certificate from a publicly trusted certificate authority.
• Private or misconfigured CA certificates are rejected by the public trust store — reissue through a public CA (Let's Encrypt is free and ACME-automatable) rather than trying to get a private CA added to client trust stores.
• Install the full chain the public CA provides, not just the leaf certificate.
• Reserve private/internal CAs for genuinely internal services where you control every client's trust store — keep them off any hostname that resolves publicly.

How to verify the fix

Re-run the SSL/TLS checker against the domain and confirm the certificate now chains to a publicly trusted root. In a browser, the padlock should show with no interstitial warning.