net::ERR_CERT_DATE_INVALID

The interstitial shows "NET::ERR_CERT_DATE_INVALID"; automation tools print "net::ERR_CERT_DATE_INVALID". When Chrome concludes that the device clock itself is wrong, it shows a dedicated "Your clock is ahead/behind" page instead of the usual warning.

Chrome, Edge and other Chromium browsers — the certificate is expired or not yet valid

What it means

The site's certificate (or one in its chain) is outside its validity period according to the device's clock: it has expired or is not valid yet. Chrome blocks the page with "Your connection is not private". When a single site shows it, the site's certificate expired; when every site does, the computer's date is wrong.

Why it happens

• The site's certificate expired

  common

  Renewal failed or was never automated. Public certificate lifetimes are shrinking (200 days from March 2026, 47 days by 2029), so manual renewal no longer works.

• The device's date is wrong

  common

  Dead CMOS batteries, dual-boot time-zone mix-ups and manually set clocks make valid certificates look expired or not yet valid.

• The renewed certificate is not served

  occasional

  The web server, load balancer or CDN still serves the old certificate after renewal.

How to fix it

1. 1.

   Site owners: check the served dates

   Compare notAfter with today; check from outside, through the same path visitors use.

   echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null \
     | openssl x509 -noout -startdate -enddate

2. 2.

   Site owners: renew and automate

   Renew, reload the TLS terminator, and make sure an automatic renewal job exists and runs.

   sudo certbot renew && sudo systemctl reload nginx
   systemctl list-timers | grep -i certbot      # is automatic renewal scheduled?

3. 3.

   Users: fix the device clock

   Enable automatic time; do not bypass the warning, since an expired certificate can no longer be relied on to identify the site.

   Users: if many sites show this error at once, fix the device clock first
   (Windows: Settings → Time & language → Set time automatically; macOS: Date & Time → Set automatically).

← Browse the full signature error database