ERR_CERT_DATE_INVALID: The certificate has expired or is not yet valid
Also searched as: net::ERR_CERT_DATE_INVALID · certificate expired · NET::ERR_CERT_DATE_INVALID
Is ERR_CERT_DATE_INVALID happening on your domain?
The SSL checker returns the exact notAfter date and days remaining for the hostname, which immediately separates 'genuinely expired' from 'your clock is wrong'.
Free, no signup. Runs from outside your network, which is the only way to tell a server fault from a local one.
Short answer
The certificate the server presented is outside its validity window — almost always expired. Either the certificate genuinely lapsed, or the device's clock is wrong so a valid certificate looks expired.
What ERR_CERT_DATE_INVALID means
Every TLS certificate carries a notBefore and notAfter timestamp. ERR_CERT_DATE_INVALID means the current time is outside that window. Browsers refuse to establish trust and show a full-page interstitial rather than loading the site.
Causes and fixes, most likely first
The certificate expired and auto-renewal silently stopped.
Renew immediately. For Let's Encrypt, run the renewal manually and read the output — the usual cause is a failing HTTP-01 challenge after a redirect or firewall change.
Renewal succeeded but the web server was never reloaded, so it still serves the old certificate from memory.
Reload nginx/Apache after renewal and add that reload to the renewal hook so it never gets missed again.
The device's system clock is wrong, making a valid certificate look expired.
Set the device date and time to automatic. If only one machine sees the error, this is nearly always why.
One hostname renewed but a second (www, api, a subdomain) did not.
Check every hostname separately. Certificates are per-name; www.example.com and example.com are different entries unless the certificate covers both.
ERR_CERT_DATE_INVALID on specific platforms and devices
How to stop it happening again
- •Monitor certificate expiry on every hostname, including www and subdomains, with alerts 30, 14 and 7 days out.
- •Add a server reload to the certificate renewal hook so a successful renewal always takes effect.
- •Alert on the certificate the server actually serves, not the one on disk — they diverge whenever a reload is missed.
Frequently asked questions
How do I fix ERR_CERT_DATE_INVALID?
Check the certificate's expiry with an external SSL check. If it is genuinely expired, renew and reload the web server. If the check says the certificate is valid, your device clock is wrong — set date and time to automatic.
Why does my certificate say expired when I just renewed it?
The web server is still serving the old certificate from memory. Renewal writes new files to disk; only a reload makes the server present them.
Is it safe to continue past ERR_CERT_DATE_INVALID?
On a site you own and are actively fixing, the risk is low. On any other site, no — an expired certificate cannot be distinguished from an interception attempt from the browser's side.