ERR_CERT_DATE_INVALID: Expired Certificate or Wrong Clock?
The site's SSL certificate has expired or your device clock is wrong. How to tell which one it is and how to fix it.
On this page
NET::ERR_CERT_DATE_INVALID: what it means
Every SSL certificate has a start date and an expiry date, just like a passport. On every connection the browser compares them with your device's clock. If "today" falls outside that window it stops with a warning. That is why the same error has two causes: an expired certificate on the server, or a wrong clock on your device, which makes even valid certificates look "expired" or "not yet valid".
An expired certificate is not an expired domain. When the domain expires you usually get other errors (the site cannot be found, or a parking page appears). See my domain expired.
How it looks in Chrome, Edge, Firefox and Safari
| Browser | What the page says | Code |
|---|---|---|
| Chrome | "Your connection is not private" (expired certificate) | NET:: |
| Chrome | "Your clock is behind" or "Your clock is ahead" (when Chrome detects that your device's time is wrong) | NET:: |
| Edge | "Your connection isn't private" | NET:: |
| Firefox | "Warning: Potential Security Risk Ahead" or, when it detects a wrong time, "Your Computer Clock is Wrong" | SEC_ (the site's certificate expired), SEC_ (an intermediate or root certificate expired), MOZILLA_ (not valid yet) |
| Safari | "This Connection Is Not Private" | — |
If the site uses HSTS, the browser does not even offer a way to continue. See "You cannot visit this site right now because the website uses HSTS".
If you are a visitor
- Check the date, time and time zone. Turn on automatic time and time zone on your device and reopen the browser.
- Old computer that "forgets" the time? If the date jumps back to an old year after every shutdown, the motherboard battery (CMOS) is dead. Replacing it fixes the problem.
- Try a second, well-known https site. If every site fails, your device is at fault. If only one fails, that site is.
- Very old device without updates? It keeps an old list of "root" certificates. When an old root expires, many sites stop opening (this happened on a large scale in 2021 on old phones and computers). Update the operating system and browser.
- Check your antivirus. If it inspects HTTPS traffic with its own certificate and is out of date, it can cause this error. Update it or temporarily turn off its "HTTPS scanning".
- Don't continue if you would enter passwords or card details. Tell the owner that their certificate has expired.
If you own the website: the usual causes
- Automatic renewal failed. Let's Encrypt certificates last 90 days and renew automatically, but only if the validation check passes. It fails when the domain now points to a different server (you changed DNS or hosting), when the check file under
/.well-known/acme-challenge/cannot be reached (port 80 closed, a redirect to another server, a firewall or a proxy such as Cloudflare), or when the scheduled task (cron) has stopped. Run the renewal manually, read the error message and fix the cause. Steps in our SSL renewal guide. - Renewed, but the server shows the old one. The web server needs a reload to pick up the new certificate. If a CDN, load balancer or proxy sits in front of the site, it has its own copy that must be updated too.
- Expired intermediate or wrong chain. With an old "CA bundle" your own certificate is valid but the intermediate has expired (Firefox shows
SEC_). Install your Certificate Authority's current full chain (fullchain).ERROR_ EXPIRED_ ISSUER_ CERTIFICATE - The new certificate went to the wrong place. E.g. www was updated but not the non-www name, or a different virtual host. Test every name the site uses.
- Site behind Cloudflare. Visitors (and the SSL Checker) see Cloudflare's certificate. If your server's certificate expires, depending on the SSL setting visitors see a Cloudflare error page (e.g. 526) or nothing, not this message. See Cloudflare errors 521, 522, 525, 526.
Why automatic renewal matters more and more: the CA/Browser Forum, which sets the rules for public certificates, voted (SC-081) to shrink their maximum lifetime: up to 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Let's Encrypt will move to 64 days from 10 February 2027 and to 45 days from 16 February 2028. You need automatic renewal and an alert when it fails.
See when it expires and whether a new certificate was issued
The SSL Checker shows the expiry date, days left, the issuer and whether the chain is complete. CT Watch shows whether a new certificate was actually issued: if there is a new one there while the SSL Checker still shows the old one, the server never loaded it. For many domains at once use the bulk checker, and with a free account Monitors email you before expiry.
→ SSL Checker → CT Watch → Bulk SSL Checker → MonitorsMore: my SSL expired, how do I renew it, free SSL with Let's Encrypt, ERR_
Common mistakes
- Renewing and never checking from outside what the server actually serves.
- Relying on automatic renewal with no alert if it fails.
- Changing hosting or DNS and forgetting that renewal now happens on the new server.
- Confusing certificate expiry with domain expiry.