What does the warning really mean?
With HTTPS, a browser checks the certificate, domain name, validity and chain of trust. If it cannot reliably confirm one of these, it displays a warning. This does not automatically mean the website is malicious, but it does mean the normal identity protections of the connection cannot currently be considered verified.
Most common causes
- An expired or not-yet-valid certificate.
- A certificate that does not cover the domain being opened.
- A server that fails to send the correct intermediate certificate chain.
- An incorrect date or time on your device.
- A public Wi-Fi network intercepting the initial connection for its login portal.
- Security software, a corporate proxy or local device interfering with TLS.
- DNS or local settings directing you to the wrong server.
Safe steps for visitors
- Check the exact URL and make sure it is the domain you expected.
- Check your device's date and time; certificates have limited validity periods.
- On public Wi-Fi, visit a regular, non-sensitive page first and complete the network login.
- Try another trusted network or device. If the warning disappears, local configuration may be responsible.
- Do not bypass the warning on banking, shopping, email, password or card-entry pages until you know the cause.
If it happens on only one device
Compare the device clock, security software, VPN/proxy and local certificates. If other devices on the same network open the domain without a warning, a local issue is more likely than a server issue.
If everyone sees the warning
If different devices and networks reproduce it, the domain, certificate or server configuration is more likely at fault. The website owner must inspect the certificate actually served by the public production endpoint.
If you operate the website
Check certificate validity, SAN names, the full chain, automated renewal and configuration on all proxies/CDNs. After renewal, verify that the production endpoint really presents the new certificate—not only an origin server visitors cannot access directly.
For multiple domains or subdomains, check each hostname separately. A certificate for example.com does not automatically cover every subdomain unless included in SAN or an appropriate wildcard.
Does a padlock mean the website is trustworthy?
No. HTTPS encrypts the connection and validates the domain under its certificate; it does not establish business honesty. Fraudulent websites can use valid TLS certificates too. For unfamiliar stores, also verify the business identity, payment terms and other independent signals.
Frequently asked questions
Can I just click Proceed?
Not with sensitive data. Find out why the warning appeared first.
Does HTTPS prove an online store is not a scam?
No. HTTPS is an important technical signal, not verification of the seller's legitimacy.
Why does the warning disappear on mobile data?
Local Wi-Fi, a captive portal, proxy or security system may affect the TLS connection. Comparing networks helps narrow down the cause.
Can an incorrect device clock really cause a certificate error?
Yes. Browsers check certificate validity dates, so a seriously incorrect system clock can trigger the warning.