The remote certificate is invalid because of errors in the certificate chain: NotTimeValid

HttpClient reports it as the inner exception of "The SSL connection could not be established, see inner exception.". Several flags may be listed together, e.g. "NotTimeValid, UntrustedRoot".

.NET SslStream / HttpClient — X509ChainStatusFlags.NotTimeValid

What it means

A certificate in the chain .NET built is outside its validity period on this machine's clock: expired, or not yet valid. NotTimeValid does not say which certificate; the chain elements in a validation callback do. The root and the name were fine, otherwise other flags would appear alongside.

Why it happens

• The server's certificate (or an intermediate) expired

  common

  Renewal did not happen, or the renewed certificate was not bound (IIS binding, Kestrel config, Azure/Key Vault reference, load balancer).

• A brand-new certificate on a client whose clock is behind

  occasional

  Certificates valid from "now" fail on machines a few minutes behind.

• The client's clock is wrong

  occasional

  VMs restored from snapshots, devices without NTP, or containers on a drifting host.

How to fix it

1. 1.

   Check the served certificate's dates

   Compare notBefore and notAfter with the current UTC time.

   echo | openssl s_client -connect api.example.com:443 -servername api.example.com 2>/dev/null \
     | openssl x509 -noout -subject -startdate -enddate

2. 2.

   Log the failing chain element

   A validation callback that logs ChainElementStatus and returns the default decision shows which certificate is out of date without weakening validation.

   // Log which certificate failed and why, without accepting it
   var handler = new HttpClientHandler
   {
       ServerCertificateCustomValidationCallback = (msg, cert, chain, errors) =>
       {
           foreach (var element in chain!.ChainElements)
               foreach (var status in element.ChainElementStatus)
                   Console.WriteLine($"{element.Certificate.Subject}: {status.Status} {element.Certificate.NotAfter:u}");
           return errors == System.Net.Security.SslPolicyErrors.None;
       },
   };

3. 3.

   Renew and rebind

   Renew the certificate and update every binding that serves it.

   sudo certbot renew && sudo systemctl reload nginx     # or renew in your CA / key vault and redeploy

← Browse the full signature error database