All tools

Guides Certificates

ERR_CERT_DATE_INVALID: what it means

Updated 4 min read

Short answer

The certificate is expired, or not valid yet, by the clock of the device showing the error. If every visitor sees it, your certificate really has expired, or one of your servers still sends an old one. If one device sees it, that device’s clock is wrong.

What to do: check the certificate’s dates from outside. If it expired, renew it and reload the server; if it didn’t, fix the device’s date and time.

Expiry Watch checks the certificate your site serves every day and emails you before it expires, or when a renewal looks late. Free, with no account. Watch a domain

Check the dates from outside

A certificate is valid between two dates: notBefore and notAfter. Ask the server for its certificate and print both. expired.badssl.com is a public test site that serves an expired one on purpose:

echo | openssl s_client -connect expired.badssl.com:443 \
    -servername expired.badssl.com 2>/dev/null \
  | openssl x509 -noout -dates
notBefore=Apr  9 00:00:00 2015 GMT
notAfter=Apr 12 23:59:59 2015 GMT

OpenSSL’s own verdict, from the same connection:

echo | openssl s_client -connect expired.badssl.com:443 \
    -servername expired.badssl.com 2>&1 \
  | grep 'Verify return code'
    Verify return code: 10 (certificate has expired)

Captured on October 24, 2026 with OpenSSL 3.6.4. Run it with your own name, from a machine whose clock you trust:

  • notAfter is in the past: the certificate has expired, for everyone. Fix it on the server.
  • Both dates are fine: the server is right, and the device showing the error has the wrong date or time. Fix the device.
  • Fine sometimes, expired other times: one of the site’s servers or addresses still sends an old certificate.

If everyone sees it

The certificate expired, and the renewal either didn’t happen or didn’t reach the server.

  1. Renew it. With Certbot, sudo certbot renew renews whatever is due. If it fails, Certbot renew failed matches the error to its cause.
  2. Reload the server. A web server keeps serving the certificate it loaded until it reloads, even after the file on disk is new. Site still shows the old SSL certificate covers nginx, Apache and HAProxy.
  3. Check every address. If the check above sometimes shows a new notAfter and sometimes the old one, one server is behind. The per-address check finds it, and the same goes for a CDN or load balancer holding its own copy.
  4. Find out why it lapsed. If renewal is meant to be automatic, is Certbot auto-renewal working? checks the timer and the logs. Let’s Encrypt no longer emails before expiry; it stopped in June 2025.

Visitors get the new certificate on their next connection. A browser can keep using a connection it already has open, so someone with the site open may need to close the tab.

If only one device sees it

Google’s own help for Chrome lists the error with two clock messages, “Your clock is behind” and “Your clock is ahead”, and explains: “You can get this error if your computer or mobile device’s date and time are inaccurate” (Chrome Help). Firefox says so on its error page: “Your device’s clock is set to” a date, and “If it’s wrong, you can change it in your device’s system settings” (certError.ftl).

Set the device’s date, time and time zone to update automatically, then reload the page. A clock that runs behind also rejects certificates that are too new: a site that renewed today looks “not valid yet” to a device that thinks it’s last week.

If the clock is right and the error persists on one device only, compare what that device receives with the check above. A network that intercepts encrypted traffic, such as a company proxy, presents a certificate of its own.

What the error means exactly

Chromium defines it in its source: “The server responded with a certificate that, by our clock, appears to either not yet be valid or to have expired” (net_error_list.h, CERT_DATE_INVALID). It lists three possible causes: an attacker presenting an old certificate, a misconfigured server “not presenting a valid cert”, or “Our clock is wrong.”

Firefox splits the same problem by date. SEC_ERROR_EXPIRED_CERTIFICATE is defined in NSS, the library Firefox uses for TLS, as “Peer’s Certificate has expired” (SECerrs.h), and its error page says the certificate “will not be valid until” a date when notBefore is still in the future.

Sources

All sources were checked on October 24, 2026. The command output comes from our own runs on that date.

Keep reading