Android's certificate store is updated with the system, so an unpatched device rejects certificates issued by CAs it has never heard of and reports them as date-invalid after the old root expires.
Android's certificate store is updated with the system, so an unpatched device rejects certificates issued by CAs it has never heard of and reports them as date-invalid after the old root expires.
Set date and time to automatic, then update Android System WebView and Chrome from the Play Store. On Android 7.1 or older, expired ISRG/Let's Encrypt roots cause this permanently — the site must serve an alternate chain.
Android has its own failure mode, but ERR_CERT_DATE_INVALID has a wider set of causes. The most common one overall is: The certificate expired and auto-renewal silently stopped.
Renew immediately. For Let's Encrypt, run the renewal manually and read the output — the usual cause is a failing HTTP-01 challenge after a redirect or firewall change.
The SSL checker returns the exact notAfter date and days remaining for the hostname, which immediately separates 'genuinely expired' from 'your clock is wrong'.
Android's certificate store is updated with the system, so an unpatched device rejects certificates issued by CAs it has never heard of and reports them as date-invalid after the old root expires.
Set date and time to automatic, then update Android System WebView and Chrome from the Play Store. On Android 7.1 or older, expired ISRG/Let's Encrypt roots cause this permanently — the site must serve an alternate chain.
The certificate the server presented is outside its validity window — almost always expired. Either the certificate genuinely lapsed, or the device's clock is wrong so a valid certificate looks expired.