WebCrawler API logoWebCrawler API

How to fix net::ERR_CERT_SYMANTEC_LEGACY in Puppeteer and Playwright?

Puppeteer

net::ERR_CERT_SYMANTEC_LEGACY means your browser (Chrome, Edge, or any Chromium-based browser—including Puppeteer and Playwright) has encountered a TLS certificate that chains to one of Symantec's legacy certificate authorities (Symantec, VeriSign, Thawte, GeoTrust, RapidSSL). Chrome permanently removed trust for these CAs in 2018 after Symantec was found to have mis-issued certificates without proper validation. This is not an expiry issue; even a brand-new certificate will fail if it's signed by the old Symantec infrastructure.

Why simply renewing the certificate won't fix this

The most common mistake is assuming the problem is a stale or expired certificate. It's not. If your site's certificate was originally issued by legacy Symantec and you renew it through the same CA, the new certificate will still chain to the distrusted root and fail with the same error:

const browser = await puppeteer.launch();
const page = await browser.newPage();
// This will still fail with ERR_CERT_SYMANTEC_LEGACY
// even if the certificate is brand new, because
// it's still signed by the legacy Symantec root
await page.goto('https://your-symantec-cert-site.com');

The problem is the root cause, not the expiry date.

The fix: Reissue from a trusted CA

Symantec's certificate business was sold to DigiCert in 2017. To fix this, you must reissue your certificate from DigiCert's current infrastructure (or any other currently-trusted CA like Let's Encrypt, Comodo, GlobalSign, etc.). The new certificate will chain to a trusted root that Chrome recognizes.

For scraping purposes, ignoreHTTPSErrors can bypass this locally for one-off testing:

const browser = await puppeteer.launch();
const page = await browser.newPage();
await page.goto('https://your-symantec-cert-site.com', {
  ignoreHTTPSErrors: true // Only for testing; don't rely on this in production
});

However, this is a workaround only for scraping. The real fix—reissuing the certificate—must happen on the site itself.

Why it works

Chrome and other browsers maintain a list of trusted certificate authorities. Symantec's legacy CAs were removed from this list permanently because of security issues, not due to a fixable technical problem. Reissuing from a currently-trusted CA (like DigiCert) puts your certificate in the chain of trust that browsers recognize, bypassing the distrust entirely.

Tips

  • This is not an expiry problem; renewing with the same CA will fail
  • Contact your hosting provider or IT team to reissue the certificate through a trusted CA (DigiCert, Let's Encrypt, etc.)
  • If you're scraping a site with this error, it's a sign the site owner needs to update their infrastructure
  • For production scraping, do not use ignoreHTTPSErrors as a permanent solution; work with the site owner to fix the certificate
  • For actual certificate expiry issues (not distrust), see net::ERR_CERT_DATE_INVALID