SEC_ERROR_EXPIRED_CERTIFICATE

Shown under "Advanced" as "Error code: SEC_ERROR_EXPIRED_CERTIFICATE", with the expiry date and the device's current date in the warning text. An expired intermediate or root is reported as SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE.

Firefox (NSS) — "Warning: Potential Security Risk Ahead", certificate expired

What it means

The site's certificate expired (by the device's clock), and Firefox refuses to treat it as proof of the site's identity. One site failing means the site did not renew; every site failing means the device's date is wrong.

Why it happens

• The site's certificate expired

  common

  Renewal failed or was never automated.

• The device clock is wrong

  common

  A date in the future (or far past) makes every certificate fail; compare the device time shown on the warning page with the real date.

• An old certificate is still deployed somewhere

  occasional

  One node behind a load balancer or a CDN edge still serves the expired certificate.

How to fix it

1. 1.

   Site owners: check the served end date

   Check through the same path visitors use; with several nodes, check each.

   echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null \
     | openssl x509 -noout -enddate

2. 2.

   Renew, reload, automate

   Renew the certificate, reload every TLS terminator, and make sure renewal runs automatically.

   sudo certbot renew && sudo systemctl reload nginx

← Browse the full signature error database