Site deemed 'Not secure' despite having cert and using https URL

Question

Site deemed 'Not secure' despite having cert and using https URL

Brown, Matt 146

I built out the website in IIS. When I go to the webpage the page itself shows up, but I am getting the icon for saying the URL is 'Not secure' even though I am using a https based URL. The icon itself is next to the URL and where the site information icon usually is. I do not getting the page itself saying it isn't secured with the typical option to continue forward. I do have a cert attached to the site. The cert is set up as the same as the one in Prod. Only real difference is this server is 2022 as where Prod is 2016. I even copied in the applicationHost and web.config from Prod as part of setting up the new server.

Safiullah Roohani 0 Reputation points

2026-01-20T22:47:31.62+00:00

Safiullah Roohani

5 answers

Your answer

Safiullah Roohani 0 Reputation points

2026-01-20T22:47:31.62+00:00

Safiullah Roohani

Answer 1

Brown, Matt 146

The answer was something incredibly random. I did a OS update for my Citrix environment for a separate issue, and that's what resolved the unsecured showing.

0 comments

Answer 2

Brown, Matt 146

I'm not finding a private key for either Prod or Test so I must not be looking at the right spot. I'm not seeing where the TLS version is defined. The only version I see looking at the site info via the one icon is version 3 and it's the same for Prod and Test.

Jack Dang (WICLOUD CORPORATION) 17,585 Reputation points Microsoft External Staff Moderator

2026-01-16T02:44:48.6966667+00:00

Hi @Brown, Matt ,

Thanks for your feedback.

For the private key, open IIS Manager -> server name -> Server Certificates, then open the certificate and confirm it shows “You have a private key that corresponds to this certificate.”

Regarding TLS, the “version 3” you’re seeing in the site info is likely HTTP/3, not the TLS version. TLS isn’t defined at the site level in IIS; it’s negotiated per connection. You’ll want to compare the negotiated TLS protocol and cipher for Prod vs Test in the browser’s connection/security details rather than IIS itself.

If both look identical, the next step would be to compare the server-wide TLS/cipher configuration between Prod and Test, as that’s where Server 2022 differences usually show up.

Answer 3

Hi @Brown, Matt ,

Thanks for reaching out.

If the site is loading over HTTPS but the browser still shows “Not secure” in the address bar, that usually means the TLS connection is working, but the browser doesn’t fully trust something about it. If you click the “Not secure” indicator (or the lock icon) in the browser’s address bar, the browser will usually tell you what it doesn’t trust, which can help narrow down the cause quickly.

A few common things I’d suggest checking:

Certificate trust chain

Even if the same certificate works fine in Prod, the new Server 2022 machine may be missing one of the intermediate or root certificates. Browsers require the full chain to be present and trusted.

In IIS, open the certificate and check the Certification Path
Make sure any intermediate certs are installed under Intermediate Certification Authorities
This is a pretty common issue when moving to a new server or OS version

Certificate name mismatch

Double-check that the certificate’s CN or SAN exactly matches the URL you’re browsing to.

For example, https://site vs https://site.domain.com
If the names don’t match, the browser will still flag the connection even though HTTPS is being used

Mixed content

If the page itself is HTTPS but it’s loading scripts, images, or CSS over HTTP, browsers will downgrade the security indicator.

Open DevTools and check the Console for any Mixed Content warnings
This can easily happen when configs are copied from another environment

TLS / cipher differences on Server 2022

Server 2022 has stricter TLS and cipher defaults compared to 2016.

If the server ends up negotiating something deprecated, some browsers may still show “Not secure”
You can confirm this by checking the connection details in the browser

IIS bindings / SNI

It’s also worth rechecking the HTTPS binding in IIS:

Correct certificate selected
Correct hostname
SNI enabled if multiple sites share the same IP

Since you’re not seeing a full-page certificate warning, that’s actually a good sign. The connection is being established securely, but something (most often a missing intermediate cert or mixed content) is preventing the browser from marking it as fully trusted.

Hope this helps! If my answer was helpful - kindly follow the instructions here so others with the same problem can benefit as well.

Brown, Matt 146 Reputation points

2026-01-12T19:39:36.0133333+00:00

I click on the icon and it says 'Your connection to this site isn't secure.' The cert is shown as being valid. It is not It is the same one in prod. I am using the same cert in Test before the server was upgraded from 2016 to 2022.

Cert chain for both Prod and Test are the same. CN looks to be correct. I get no messages about mixed content.
Jack Dang (WICLOUD CORPORATION) 17,585 Reputation points Microsoft External Staff Moderator

2026-01-13T03:14:26.8866667+00:00

Hi @Brown, Matt ,

Thanks for confirming. Since the cert is valid, the chain matches Prod, the CN/SAN is correct, and there’s no mixed content, this likely isn’t a certificate issue.

Given the only real change is Server 2016 -> 2022, the most likely causes are TLS/cipher negotiation differences or an IIS binding/SNI issue after the upgrade. At this point, I’d recommend re-verifying the HTTPS binding (hostname and SNI), confirming the certificate is properly associated with its private key, and ensuring the connection is negotiating TLS 1.2 or newer.

If the issue persists, comparing the negotiated TLS details between Prod and Test side-by-side usually exposes the difference very quickly.

Hope this helps narrow it down.
Brown, Matt 146 Reputation points

2026-01-15T05:58:40.67+00:00

What are the bes ways of doing those things?
Jack Dang (WICLOUD CORPORATION) 17,585 Reputation points Microsoft External Staff Moderator

2026-01-15T06:31:49.63+00:00

Hi @Brown, Matt ,

You can approach it like this:

HTTPS binding / SNI: In IIS, check the site’s HTTPS binding, confirm the correct hostname, and ensure SNI is enabled if needed.

Certificate private key: Make sure the cert shows it has a corresponding private key; if not, re-import the PFX.

TLS version / cipher: Click the browser lock icon to see the negotiated TLS version and cipher, and compare with Prod.

If my answer was helpful - kindly follow the instructions here so others with the same problem can benefit as well.

Answer 4

Bruce (SqlWork.com) 83,821

SSL certificates include the domain name. This match the domain in the url. Unless the test server has the same url (say you are using localhost to override) as production the certificate will not work.

the test need it on certificate based on its domain name. Generally you will to buy this certificate. You can use a self signed, but the the self signed certificate needs to be added as trusted to every client.

0 comments

Answer 5

The issue you are experiencing, where the site is deemed 'Not secure' despite having a certificate and using an HTTPS URL, can be caused by several factors. Here are some troubleshooting steps you can take:

Certificate Validation: Ensure that the SSL certificate is properly installed and that it includes a valid private key. You can check this by attempting to export the certificate from the Certificates MMC; if you cannot export the private key, it indicates a problem with the certificate.
SSL Configuration: Verify that the certificate is correctly bound to the site in IIS. You can use the command netsh http show ssl to check the SSL configuration. Make sure the certificate hash is correctly registered and is not NULL or an invalid GUID.
Mixed Content: Check if there are any mixed content issues on your site. This occurs when the page is served over HTTPS but includes resources (like images, scripts, or stylesheets) that are loaded over HTTP. Browsers will flag the site as 'Not secure' in such cases.
Server Compatibility: Since you mentioned that the new server is running Windows Server 2022 while the production server is on 2016, ensure that there are no compatibility issues with the SSL/TLS protocols being used. You might want to check the supported protocols on both servers and ensure they match.
Browser Cache: Sometimes, browsers cache SSL states. Clear your browser cache or try accessing the site in a private/incognito window to see if the issue persists.

By following these steps, you should be able to identify and resolve the issue causing the site to be marked as 'Not secure'.

References:

Share via

Site deemed 'Not secure' despite having cert and using https URL

5 answers

Your answer