1

I am using a valid certificate but still chrome is showing me “Not Secure” when browsing to my site.

This are the steps I have made:

  • I have installed a self signed certificate in my testing server (windows server 2016)
  • Deployed an IIS site on my server using my self signed certificate
  • Added the certificate to the "Trusted Root Certificate Authorities" in my client host

More info:

  • I am using Windows Server 2016, IIS 10, Chrome 88.x
  • I have tried to deploy my site on another machine(also windows server 2016) and it works!
  • I have tried to change the server accepted protocols to TLS 1.2 only but it didn't help

What else can I check? Please tell me if any info is missing certificate

chrome

1
  • You indicated the client is configured to trust the certificate but is the server configured to use it? Your screenshot doesn't seem to indicate you are visiting a secure HTTP website. Unless this is a server NOT connected to the internet you really should consider NOT using self-signed certificates when Let's Encrypt are trusted by all major browsers on all platforms.
    – Ramhound
    Jan 29, 2021 at 15:53

2 Answers 2

1

You are probably visiting it, using http, which doesn't use encryption at all. Try https://cyapi.cynet.com. For me it shows it as secure

You can also try setting up automatic https upgrade or turn off http support at all for this website, so users won't be able to use insecure protocol

1

Apparently it was because my self-signed cert was with a too long expiration date.

3
  • If this is what fixed your problem, then you should accept it as an answer. Feb 25, 2021 at 16:32
  • 1
    Is there a reference that describes what's too long? Oct 25, 2022 at 20:49
  • I cant upvote until you provide more information. What is too long. Where did you find what the limit was etc. Mar 5, 2023 at 10:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .