NET::ERR_CERT_DATE_INVALID error: causes and fixes

"Your connection is not private", followed by the code NET::ERR_CERT_DATE_INVALID: this is the message Chrome and Edge show when the certificate's dates don't match the current date. Firefox shows SEC_ERROR_EXPIRED_CERTIFICATE, and Safari shows "This certificate has expired".

Most often, the site's certificate has expired. But first you need to figure out which side the problem is on.

Step 1: is the problem on the site or the computer?

Run the domain through the SSL checker, or open the site from another device, for example your phone on cellular data.

• The error shows up everywhere: the site's certificate has expired. Go to step 2.
• The error only shows up on one device: the problem is local. See "On the visitor's side" below.

Step 2: on the site's side, find out why the certificate expired

Automatic renewal failed

This is the most common cause with Let's Encrypt. On the server:

sudo certbot renew --dry-run

The error message usually points to the cause: port 80 unreachable, DNS no longer pointing to the server, webroot not found, invalid DNS plugin credentials. Fix it, then run sudo certbot renew.

The certificate was renewed but isn't being served

The new certificate is on disk, but the web server is still serving the old one, loaded in memory. Compare the two:

sudo certbot certificates          # date on disk
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate   # date actually served

If they differ, reload the service: sudo systemctl reload nginx, or apache2, haproxy… Then add a deploy hook so it doesn't happen again. The Let's Encrypt and Certbot guide explains how.

A paid certificate wasn't renewed

Forgotten order, expired credit card, reminder email sent to a former employee… Renew with the provider, then install the new certificate with its intermediates. See How to renew your SSL certificate.

Only one of the servers is affected

Behind a load balancer, or with several entry points (CDN, origin server, subdomains), a single node can serve an expired certificate. The error then appears "every other time". Check each server individually.

The certificate isn't valid yet

Less common: the certificate's start date is in the future. This happens when the clock on the server that generated the certificate is wrong. Check the server's NTP synchronization (timedatectl).

On the visitor's side: when only your device is affected

• Wrong system date and time: this is the number one cause. Turn on automatic time setting, then reload the page.
• Antivirus or corporate proxy inspecting HTTPS traffic with its own certificate: update it, or temporarily turn off HTTPS scanning to test.
• Very old device: its root certificates are out of date. Update the operating system.

Should you click "Proceed to the site"?

As a visitor, only if you know exactly why the error appears. If the site uses HSTS, the browser doesn't even offer this option.

As a site owner, it's not a solution: most visitors will leave, APIs and mobile apps will stop working, and search engine crawlers won't be able to crawl your pages.

Never see this error on your sites again

This error is entirely avoidable: the expiration date is known months in advance. With SSL Expiration Reminder, every certificate is checked automatically, and you're notified before expiry by email, Slack or Telegram, along with anyone you add as a recipient. The free plan covers 3 domains.