SSL errors
NET::ERR_CERT_DATE_INVALID: Expired Certificate or Wrong Clock?
NET::ERR_CERT_DATE_INVALID appears when the current date falls outside a certificate's validity dates. Here is how to tell an expired certificate from a wrong clock, and how to fix each.
NET::ERR_CERT_DATE_INVALID means your browser compared today’s date with the validity dates inside a website’s SSL certificate and found a mismatch. Either the certificate has expired (or is not valid yet), or the clock on your device is wrong. Site owners fix it by renewing and installing a current certificate. Visitors fix it by correcting their device’s date, time and time zone.
What does NET::ERR_CERT_DATE_INVALID mean?
It means the certificate is outside its validity window from your device’s point of view. Every certificate carries two dates: “Not Before” (when it starts to be valid) and “Not After” (when it expires). If the device clock reads a time before the first or after the second, Chrome and Edge block the page with “Your connection is not private” and this error code.
The browser cannot tell whether the certificate or the clock is wrong. That is why the same code shows up for two very different problems. The table below helps you sort them out.
| Cause | Who fixes it | Typical sign |
|---|---|---|
| Certificate has expired | Site owner | Every visitor on every device sees the error |
| Certificate not valid yet | Site owner or visitor | Brand-new certificate; affects devices whose clock runs behind |
| Device date, time or time zone wrong | Visitor | Only one device fails, often on many different sites |
| Expired intermediate certificate in the chain | Site owner | Some browsers or older devices fail, others work |
| Outdated operating system or root store | Visitor | Old phones, PCs or embedded devices fail |
Your own certificate has expired?
Renewal takes a new order, validation and installation. Follow the step-by-step renewal guide to get a valid certificate back on your site.
Open the renewal guideFind out in two minutes whose problem it is
Try a second device
Open the same address on a phone using mobile data. If it loads fine there, the problem is most likely the first device.
Check the certificate dates
Run the domain through an online checker and read the 'valid from' and 'valid to' dates.
Compare with the device clock
If the certificate is valid today but your device shows a different date or year, fix the clock first.
Check the chain
If the site certificate is valid but the error persists, look for an expired intermediate certificate.
How do I fix it as a site owner?
Get a currently valid certificate onto every server that answers for your domain, together with the correct chain. In most cases that means renewing, installing the new certificate and reloading the web server.
- Confirm the expiry. Use our SSL checker to see the “valid to” date and which certificate your server actually sends.
- Get a new certificate. If your order has ended, renew an SSL certificate with a fresh order and complete validation again.
- Use your plan term if you have one. On a multi-year plan, a single certificate can still expire before the plan ends, because each certificate follows the maximum lifetime set by the CA/Browser Forum. In that case you usually reissue an SSL certificate under the same plan instead of buying again.
- Install it everywhere. Replace the old certificate on the web server, load balancer, CDN, mail server and any control panel that serves the domain.
- Install the current chain. Use the intermediate bundle your CA delivered with this order, not an old one copied from a backup.
- Reload and retest. Reload or restart the service, then check again from outside your network.
Tip: Renewed but the error is still there? The server is almost always still sending the old certificate. Check other virtual hosts, a reverse proxy, a CDN edge or a second server behind the load balancer.
Common site-side causes and fixes
| What you see | Likely cause | Fix |
|---|---|---|
| Checker shows the old expiry date | New certificate uploaded but not bound to the site | Bind it to the right site or virtual host, then reload |
| Works on www, fails on the bare domain | Two server blocks, only one updated | Update every block or listener that serves the domain |
| Fails only through the CDN | CDN still holds the old certificate | Upload the new certificate to the CDN or switch to its managed option |
| Fails on older devices only | Expired intermediate in the bundle | Replace the bundle with the one from your current order |
How do I fix it as a visitor?
Set your device to the correct date, time and time zone, then reload the page. If the site works on other devices, the problem is almost certainly local.On Windows, you can also clear SSL state so the system stops using cached certificate data. Never click through this warning on a login or payment page.
- Turn on "Set time automatically" and "Set time zone automatically"
- Restart the browser after changing the clock
- Install pending operating system and browser updates
- Pause antivirus HTTPS scanning briefly to test
- On public Wi-Fi, finish the hotspot login page first
- Try another network to rule out a proxy
How can I avoid it in future?
Monitor every certificate’s expiry date and automate renewal and installation wherever you can. Manual reminders alone break down as certificate lifetimes shrink.
As of October 2026, a new public TLS certificate can be valid for at most 200 days. Under CA/Browser Forum ballot SC-081, the maximum drops to 100 days from 15 March 2027 and to 47 days from 15 March 2029. More frequent replacement means more chances to miss one.
Three habits that prevent expired certificates
Monitor expiry
Track every certificate, including those on CDNs, load balancers and mail servers, and alert well before the end date.
Learn moreAutomate renewal
Use ACME clients such as Certbot or acme.sh to request and install certificates without manual steps.
Learn moreKeep an owner per certificate
Name a person or team for each certificate so renewal notices never land in an unread inbox.
Related browser errors
A date error is only one of several certificate warnings. If the browser complains about the name on the certificate instead, see NET::ERR_CERT_COMMON_NAME_INVALID. For an overview of other SSL certificate errors and their causes, use our troubleshooting guide.
Stop the error for good
Renew your certificate, install it with the current chain and set up monitoring so it never lapses again.
Renew your SSL certificate