Error: NET:ERR_CERT_AUTHORITY_INVALID when accessing Site Recovery Manager client
search cancel

Error: NET:ERR_CERT_AUTHORITY_INVALID when accessing Site Recovery Manager client

book

Article ID: 450770

calendar_today

Updated On:

Products

VMware Site Recovery Manager

Issue/Introduction

Accessing the Site Recovery Manager (SRM) client using a Fully Qualified Domain Name (FQDN) triggers a security warning. The browser may display "Your connection isn't private" or a similar NET:ERR_CERT_AUTHORITY_INVALID error. This issue is typically related to browser-side security enforcement (HSTS) and corporate firewall proxy routing where FQDN traffic is subjected to SSL inspection.

Symptoms:

  • Unable to access the site recovery client when using the Fully Qualified Domain Name (FQDN). Access attempts via browser (Chrome/Edge) fails with the security warning: NET:ERR_CERT_AUTHORITY_INVALID
Your connection isn't private

Attackers might be trying to steal your information from <appliance_fqdn> (for example,
passwords, messages, or credit cards).

NET:ERR_CERT_AUTHORITY_INVALID

<appliance_fqdn> uses encryption to protect your information. When Microsoft Edge
tried to connect to <appliance_fqdn> this time, the website sent back unusual and
incorrect credentials. This may happen when an attacker is trying to pretend to be
<appliance_fqdn>, or a Wi-Fi sign-in screen has interrupted the connection. Your
information is still secure because Microsoft Edge stopped the connection before any data
was exchanged.

You can't visit <appliance_fqdn> right now because the website uses HSTS. Network
errors and attacks are usually temporary, so this page will probably work later.

  •  Accessing the site recovery client using the same appliance IP address or shortname succeeds without errors.

  • Issue persists on Chrome and Edge browsers

  • VLSR and VR appliances are configured with self-signed certificates and fqdn is included in Subject Alternative Name

Environment

  • VMware Live Site recovery 9.x

  • vSphere Replication 9.x

  • Browsers: Google Chrome, Microsoft Edge

Cause

The issue stems from browser-side security enforcement and corporate firewall proxy routing. FQDN traffic is routed through the corporate firewall/proxy for SSL inspection, triggering strict HTTP Strict Transport Security (HSTS) policies and SSL certificate/hostname verification failures when the proxy or root certificate chain is untrusted by the endpoint. IP addresses and short names are often treated as local, bypassing the proxy and strict HSTS enforcement.

Resolution

  1. Immediate Temporary Bypass: Left-click anywhere on the empty space of the browser warning page and type thisisunsafe. This action allows the browser to bypass the HSTS block for the current session.
  2. Access via IP or Shortname: Connect to the appliance using the IP address or the shortname to bypass proxy inspection.
  3. Permanent Configuration: Reconfigure the SRM and VR appliances to use the IP address instead of the FQDN to avoid HSTS enforcement.

If issue persists, contact support via the Broadcom Support Portal.

Additional Information

For persistent issues regarding browser security warnings, consult your internal Network Security team regarding SSL/TLS interception policies.

Powered by Wolken Software