NET::ERR_CERT_DATE_INVALID

Where you see it

As a full-page warning in Chrome, Edge and other Chromium browsers. The code is ERR_CERT_DATE_INVALID (−201) in Chromium’s network error list.

Your connection is not private
Attackers might be trying to steal your information from www.example.com (for example, passwords, messages, or credit cards). Learn more about this warning
NET::ERR_CERT_DATE_INVALID

Under Advanced, Chrome says which way the date is wrong (Chromium strings). For an expired certificate:

This server could not prove that it is www.example.com; its security certificate expired 3 days ago. This may be caused by a misconfiguration or an attacker intercepting your connection. Your computer's clock is currently set to …. Does that look right? If not, you should correct your system's clock and then refresh this page.

For a certificate that is not valid yet, the same sentence reads “its security certificate is supposedly from 2 days in the future”.

When Chrome is fairly sure that your own clock is wrong, it shows a different page with the same code, titled “Your clock is behind” or “Your clock is ahead”:

A private connection to www.example.com can't be established because your computer's date and time (…) are incorrect.

Firefox reports an expired certificate as SEC_ERROR_EXPIRED_CERTIFICATE.

What it means

Every certificate has a validity period: a “not before” and a “not after” date. Chrome compares them with your device’s clock. If the current time is outside that window, for the site’s certificate or for a certificate above it in the chain, Chrome cannot rely on it and stops. The certificate may really be expired, or your clock may be wrong: the error is the same, so check both.

Likely causes

The site’s certificate expired

The most common cause, and the site owner’s to fix. Check the dates from any machine with a correct clock:

openssl s_client -connect www.example.com:443 -servername www.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -enddate

Fix: renew the certificate, install it with its full chain, and reload the server (sudo certbot renew, then sudo systemctl reload nginx for certbot with nginx). Then check every place TLS ends: load balancers, CDNs and Kubernetes ingress controllers often hold their own copy.

Public TLS certificates may be valid for at most 200 days since 15 March 2026, and for at most 47 days from 15 March 2029. Renew automatically, for example with ACME, and monitor the expiry date that each endpoint actually serves.

It was renewed, but the old certificate is still served

If the certificate file on the server is new but the error remains, the server or one node behind the load balancer still serves the old one. Compare the file with what is served:

openssl x509 -in /etc/ssl/www.example.com/fullchain.pem -noout -enddate

Reload or restart the service, and test each backend directly with openssl s_client -connect <backend-ip>:443 -servername www.example.com.

The device’s clock is wrong

If many sites fail with this error on one device, its clock is off. Common reasons: a flat motherboard battery, a virtual machine restored from an old snapshot, a device without network time, or a wrong time zone. Check:

w32tm /query /status
w32tm /resync

timedatectl status
sudo timedatectl set-ntp true

On phones and laptops, turn on “Set time automatically” in the date and time settings.

An intermediate or old chain expired

If the site’s own certificate is valid, look at the other certificates the server sends (openssl s_client -showcerts). An expired intermediate or cross-signed certificate left in the chain file must be replaced with the CA’s current chain.

Check yours

Try it: Certificate decoderOpen the full tool

Runs in your browser. Nothing you paste is sent anywhere.

Paste a certificate

Try a sampleChoose a sample…A website certificate (www.example.com)An expired certificateA wildcard certificate (*.example.com)A certificate with a Common Name but no SANA self-signed root CAA complete chain: leaf, intermediate and root

-----BEGIN CERTIFICATE----- MIIC1jCCAnygAwIBAgIQNPchftz8jn6EE0nYthv4IzAKBggqhkjOPQQDAjB+MQsw CQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UECxMe U2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSswKQYDVQQDEyJQS0kgWmVy byB0byBIZXJvIFNhbXBsZSBJc3N1aW5nIENBMB4XDTI1MTEwMTAwMDAwMFoXDTI2 MDEzMDAwMDAwMFowGjEYMBYGA1UEAxMPd3d3LmV4YW1wbGUuY29tMFkwEwYHKoZI zj0CAQYIKoZIzj0DAQcDQgAEnFxMTbSS6N//zfTxXpHxlwQXb/vUy+GJ0VD/hV2T qh4hwe8YIotO6LTc8gcoN7U/lzWAxB0YGCQNdl3ZkaeNC6OCAT4wggE6MAwGA1Ud EwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMCcG A1UdEQQgMB6CD3d3dy5leGFtcGxlLmNvbYILZXhhbXBsZS5jb20wHQYDVR0OBBYE FLePvyuDFGAE/tNEqDYHGxSlxoD9MB8GA1UdIwQYMBaAFN+ph37v40SN23r6Fg/z OvSNjJqeMEgGCCsGAQUFBwEBBDwwOjA4BggrBgEFBQcwAoYsaHR0cDovL3BraS5l eGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcnQwPQYDVR0fBDYwNDAyoDCg LoYsaHR0cDovL3BraS5leGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcmww EwYDVR0gBAwwCjAIBgZngQwBAgEwCgYIKoZIzj0EAwIDSAAwRQIhAM8HGMZHERBn faVlrjwlVBfFzLIBiMhxHlwupcIdsXYfAiBjweZeZ9ch63PQ3YYp81rY4QHX1y9Q vdp9yJS+yypzgg== -----END CERTIFICATE-----

PEM text, several PEM blocks, or a .pem, .crt, .cer or .der file (drop it on the box). Certificates are public, so they are safe to paste.

DecodeClearChoose a file

Paste the site’s certificate (from the browser’s certificate viewer or openssl s_client -showcerts). The decoder shows the validity dates and how many days are left or overdue.

Learn why

• Anatomy of an X.509 certificate: the validity fields.
• Inventory, expiry and renewal and ACME and the 47-day schedule.
• The same problem in OpenSSL: verify error:num=10:certificate has expired.
• See also: Firefox’s SEC_ERROR_EXPIRED_CERTIFICATE.

In the gameLevel 8: The certificateRoyal Notary, Keystone. In development