# Why do visitors see a certificate warning on your site?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

The certificate failure check reports when a secure connection fails the checks every browser makes. Here is what each failure means and how to fix it.

The certificate failure check reports when a secure connection to your site fails a check every browser makes, such as a trusted issuer, the right name or a valid date. Visitors then see a warning instead of your site.

## What does this check look at?

It looks at whether the secure connection fails a check every browser makes, such as a trusted issuer, the right name or a valid date. When the check fails, the scan stops there and sends no request for a page.

Pulse and Deep scans both run it.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Low or medium finding | The connection failed verification, and the evidence names which check. | Fix the certificate with your host, then check again. |

Only the certificate and protocol are inspected, and no page is requested once the check fails. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label. Lockpick never rates TLS settings and certificate warnings high on their own.

### What does a confirmed finding have to show?

| Part | For this check |
| --- | --- |
| Where it starts | Every visitor's browser |
| The protection that should stop it | A trusted, current certificate for this address |
| What is reached | A browser warning before the site loads |
| What follows | Visitors blocked, or taught to click through warnings |

## Which standards does it relate to?

| Standard | Reference |
| --- | --- |
| OWASP Top Ten | `A04:2025` Cryptographic Failures |
| CWE | `CWE-295` |
| ASVS | `v5.0.0-12.2.2` |

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

## Fix it with your AI

The evidence names the failed check, which tells your host or your AI where to look.

:::fix-prompt any
Visitors to my site get a certificate warning. The scan says the connection failed this check: [paste the evidence line from the report]. Find out which certificate my host or CDN serves for this address, and fix the cause: an expired certificate, a certificate that does not cover this exact name (for example the www address), a missing intermediate certificate, or a protocol older than TLS 1.2. Tell me what you changed and how to confirm the warning is gone.
:::

## How to check

Say Atlas, our example app at `atlas.example`, added a www address after the certificate was issued. Visitors on the www address see a warning, and the evidence names the mismatch.

Run a Pulse scan from your Lockpick account to see it for your site. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### The site loads fine for me. Why does the scan fail?

Your browser may have cached an older certificate, or you may be visiting a different address than the one scanned. The evidence says which address and which check.

### Did the scan read any pages?

No. A connection that fails verification stops there, so no page is requested.

## Sources

- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07
- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07