Certificate Error

By the time this appears, the handshake has gone far enough for the server to present its identity, which means the hostname resolved, the port is right, and TLS negotiation is under way. What failed is the check that the certificate belongs to the machine the client meant to reach. The remedy differs completely depending on which part of that check failed, and the client almost always says which in the message text.

Reading the specific warning

Four separate conditions are reported under the same general label. A name mismatch means the certificate is valid but issued for a different hostname. An expiry or not-yet-valid message means the dates do not cover the present moment, either because the certificate lapsed or because the clock is wrong. An unknown or untrusted issuer means the signing authority is not in the client's trust store. An incomplete chain means an intermediate certificate was not sent. Each has a different owner and a different fix, so the wording is worth reading before anything is changed.

Hostname mismatch is the common one

Certificates are issued for specific names. Pointing a client at a bare IP address rather than the published hostname produces a mismatch every single time, and so does an old hostname from a previous brand or a regional alias the certificate does not cover. The fix is to enter the hostname exactly as the provider documents it. Readers who switched to a raw IP address to work around a resolution problem manufacture this error for themselves; the resolution problem is the one that needs solving.

Expiry, chains and the clock

An expired certificate belongs to the provider and is normally corrected within hours, because it breaks every customer at once. A missing intermediate is also the provider's, and has a giveaway signature: some clients connect while others refuse, since clients differ in whether they have cached that intermediate from earlier sessions. A wrong system date produces an identical expiry warning against a certificate that is entirely valid, so the machine's clock should be verified before the provider is blamed.

The one warning that must not be dismissed

An untrusted issuer on a corporate, school or public network usually means the connection is being intercepted, with an appliance presenting its own certificate so it can read the traffic passing through. On a managed device that root may have been installed deliberately as policy. On a network the reader does not control, it means the session is not private end to end. In that situation clicking past the warning is not a workaround; it is agreement to the interception.

Why disabling verification is the wrong fix

Most newsreaders offer a setting that accepts any certificate presented. It silences the message and keeps the traffic encrypted, but it discards the assurance that the encryption terminates at the provider rather than at whatever else sits in the path, and it will hide the next, unrelated certificate problem too. Where the actual cause is a wrong hostname or a wrong clock, both take under a minute to correct and leave the check intact.