IIS Certificate Shows NET::ERR_CERT_AUTHORITY_INVALID After Renewal

First check the certificate in the local computer Personal store. It should say that a private key is associated with it. If it does not, importing the CRT or CER file cannot repair the installation because those files contain only the public certificate. Locate the original private key and CSR, or generate a new key pair and request the provider to re-key the certificate.

The renewed certificate must match the private key created when the CSR was generated. Downloading the renewed certificate alone does not include that key. If IIS cannot show that the certificate has a private key, or the export option is disabled, the certificate was probably installed on a different server or the original CSR/key pair is missing. In that case, create a new CSR and re-key or reissue the certificate, then install the resulting certificate on the same server and export a PFX if needed.

The fact that the browser shows the new expiration dates only proves that IIS is serving the renewed certificate. It does not prove that the certificate is trusted or that the complete chain is being sent. Inspect the live endpoint with a certificate-chain checker and compare the served chain with the provider’s required intermediate certificate. If the chain is correct but trust still fails, confirm that the certificate was issued by a currently trusted public CA and that the URL is not being intercepted by a proxy or security appliance.

Make sure the certificate chain is complete, not just that an intermediate certificate exists somewhere in the certificate stores. The IIS HTTPS binding should use the renewed certificate, and the server should send the appropriate intermediate certificates to clients. Also verify that the certificate’s subject or SAN contains the exact hostname being visited. An incorrect chain, hostname, or certificate binding can all produce a browser trust error.