When accessing a Internal Audit website, for example to open the WebUI or the ClickOnce page, you might see an error like this:

Although “Your connection is not private” calls to mind a Virtual Private Network, in fact this error is the browser’s way of communicating to you that it has a problem with the server’s SSL certificate.  The more descriptive part of the message is the text below it (in this example above, NET::ERR_CERT_COMMON_NAME_INVALID).

There are a number of errors that can appear here, including those described below.

NET::ERR_CERT_COMMON_NAME_INVALID 

An SSL certificate contains the name of the website that you are visiting, and that name needs to match the address that you type into the address bar on your browser. 

For example, you might see this error on an Intranet if your server’s certificate is for server.domain.com, but you browse to https://server.

NET::ERR_CERT_AUTHORITY_INVALID

SSL works because your browser ‘trusts’ the certificates it encounters.  In order for your browser to trust a certificate it has to trust the entity that created that certificate, and this entity is known as the ‘certificate authority’ (or CA).  If a browser encounters a certificate that is ‘untrusted’ (i.e. it comes from a CA that is not trusted), then this error will be shown.

The common cause for this is that the server has a self-signed certificate (i.e. one created by the server itself, and not obtained from a trusted CA).  There are two possible solutions to this, but only one is considered secure:

The server administrator should obtain a trusted SSL certificate

The safest option is for the server admin to obtain a certificate from a CA that is trusted by the user’s computer.

The user installs the server’s certificate

It is possible to download the untrusted certificate to your computer and import it into your local certificate store, so that your browser then trusts the server.  However, this is not recommended.

NET::ERR_CERT_DATE_INVALID

This error normally indicates that the SSL certificate on the server is expired (or is not yet valid), or that the date on the user’s computer is wrong.