Browsers refuse to open your app
Untrusted TLS certificate
What this means
The security certificate your site presents is not one browsers accept. Visitors see a full-page warning before they see your app, and most of them leave at that point.
Why it matters
Beyond the visitors you lose, the warning teaches the ones who stay to click through security warnings — which is exactly the habit an attacker needs. And a connection nobody can verify can be read or altered on the way.
When this is not a problem
Internal environments deliberately using a private certificate authority are not a finding for their intended audience.
How to fix it
- Issue a certificate from a public authority — Let's Encrypt does it free and automatically.
- Make sure the certificate names every domain the app is served on, including the www variant.
- Serve the full chain, not just the leaf certificate: browsers differ in what they will fill in for you.
Prompt for your AI agent
Replace the site certificate with one issued by a public certificate authority, covering every domain the app answers on, and serve the complete certificate chain.
How to verify the fix: open the app in a private window — expect no security warning
References: cwe.mitre.org