# NET::ERR\_CERT\_AUTHORITY\_INVALID error on my website

**URL:** <https://community.letsencrypt.org/t/net-err-cert-authority-invalid-error-on-my-website/55334>\
**Category:** Help\
**Created:** [March 11, 2018, 6:20am UTC](https://community.letsencrypt.org/t/net-err-cert-authority-invalid-error-on-my-website/55334 "2018-03-11T06:20:14Z")\
**Posts on this page:** 1\
**Showing post:** 27

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [March 11, 2018, 6:58pm UTC](https://community.letsencrypt.org/t/net-err-cert-authority-invalid-error-on-my-website/55334/27 "2018-03-11T18:58:43Z")

</div>

Edit: Ping @jsha or @cpu? Half dozen+ people with incomplete chains are suddenly reporting issues at the same time. @jmorahan has the theory that [http://cert.int-x3.letsencrypt.org/](http://cert.int-x3.letsencrypt.org/) redirecting to HTTPS is breaking AIA chasing on major platforms like iOS Chrome because maybe they only support chasing over HTTP. I think he’s probably right.

* * *

@jmorahan

I like your theory better than mine, and I think you might be right.

Disclaimer: I don’t know Chrome’s code base AT ALL, and maybe it uses a different library on iOS or something. I just went searching for keywords. That said…

```
// Policy for which URLs are allowed to be fetched. This is called both for the
// initial URL and for each redirect. Returns OK on success or a net error
// code on failure.
Error CanFetchUrl(const GURL& url) {
  if (!url.SchemeIs("http"))
    return ERR_DISALLOWED_URL_SCHEME;
  return OK;
}

```

[https://cs.chromium.org/chromium/src/net/cert\_net/cert\_net\_fetcher\_impl.cc?sq=package:chromium&dr=CSs&l=164-171](https://cs.chromium.org/chromium/src/net/cert_net/cert_net_fetcher_impl.cc?sq=package:chromium&dr=CSs&l=164-171)

That sounds pretty clear…

---

_[View the full topic](https://community.letsencrypt.org/t/net-err-cert-authority-invalid-error-on-my-website/55334)._