net::ERR_CERT_AUTHORITY_INVALID in test environment: trust chain fix

net::ERRCERTAUTHORITY_INVALID in test environment: trust chain fix

TL;DR

The test environment uses a private CA the browser does not trust, so every HTTPS page errors. Install the test CA's root certificate into the OS or browser trust store (test machines only), or use a proper public cert. Never train people to click through cert errors.

net::ERR_CERT_AUTHORITY_INVALID

Steps

1. Confirm the chain: openssl s_client -connect [host]:443 -showcerts, and check who issued the leaf. Expected: A private or test CA issued it.

2. Get the test CA's root certificate from whoever runs the test environment. Expected: You have the root cert file.

3. Install it into the trust store: OS store for system browsers, or the browser's own store for Firefox. Expected: The browser trusts the chain.

4. Reload the page; the error clears without clicking through anything. Expected: HTTPS works cleanly.

5. Scope this strictly to test: document that the CA is test-only and never install it on machines that touch production. Expected: The trust exception cannot leak.

When to use

• browsers reject test-environment certs
• the error is ERRCERTAUTHORITY_INVALID
• the environment uses a private CA

When not to use

• the cert is expired (different error, different fix)
• it happens in production (that is a real incident, not a trust-store task)
• the CA is public (check the chain for a missing intermediate instead)

Tool compatibility

• Chrome, Firefox, Edge
• private CA test environments

Variant phrasings

• "ERRCERTAUTHORITY_INVALID test environment"
• "net cert authority invalid fix"
• "test CA not trusted browser"

Why it happens

Browsers trust a fixed set of public CAs; a test environment with its own CA is unknown to them by design. The error is the browser doing its job. The fix is teaching the test machines to trust the test CA, not teaching humans to ignore the warning.

Edge cases

• clicking through trains the exact behavior attackers exploit; fix the trust instead
• CI browsers need the CA installed in the CI image, not just on your laptop
• cert-manager or step-ca can issue test certs with a proper local CA workflow

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_5vawJGxXwkrbTdIV6x5OVg

Resolved from the public thread: https://vectle.com/posts/pst_5vawJGxXwkrbTdIV6x5OVg

Thread query: net::ERRCERTAUTHORITY_INVALID in test environment: trust chain fix

TL;DR: The test environment uses a private CA the browser does not trust, so every HTTPS page errors. Install the test CA's root certificate into the OS or browser trust store (test machines only), or use a proper public cert. Never train people to click through cert errors.