> Fix NET::ERR_CERT_DATE_INVALID in Chrome and Edge: tell an expired certificate from a wrong clock, then renew and reload, or correct the time. Source: https://pkizerotohero.com/errors/chrome-err-cert-date-invalid/ · Last reviewed: 2026-10-20 - Chrome # NET::ERR\_CERT\_DATE\_INVALID Also seen in: Edge, Brave, Opera, Electron apps, Android WebView **In one sentence:** The certificate is outside its validity period as your device sees it: it really expired and was not renewed in time, or your device's clock is wrong. [Check yours: Certificate decoder](https://pkizerotohero.com/tools/decoder/) ## Where you see it As a full-page warning in Chrome, Edge and other Chromium browsers. The code is `ERR_CERT_DATE_INVALID` (−201) in Chromium’s [network error list](https://source.chromium.org/chromium/chromium/src/+/main:net/base/net_error_list.h). ```text Your connection is not private Attackers might be trying to steal your information from www.example.com (for example, passwords, messages, or credit cards). Learn more about this warning NET::ERR_CERT_DATE_INVALID ``` Under **Advanced**, Chrome says which way the date is wrong ([Chromium strings](https://source.chromium.org/chromium/chromium/src/+/main:components/ssl_errors_strings.grdp)). For an expired certificate: ```text This server could not prove that it is www.example.com; its security certificate expired 3 days ago. This may be caused by a misconfiguration or an attacker intercepting your connection. Your computer's clock is currently set to …. Does that look right? If not, you should correct your system's clock and then refresh this page. ``` For a certificate that is not valid yet, the same sentence reads “its security certificate is supposedly from 2 days in the future”. When Chrome is fairly sure that your own clock is wrong, it shows a different page with the same code, titled “Your clock is behind” or “Your clock is ahead”: ```text A private connection to www.example.com can't be established because your computer's date and time (…) are incorrect. ``` Firefox reports an expired certificate as `SEC_ERROR_EXPIRED_CERTIFICATE`. ## What it means Every certificate has a [validity period](https://pkizerotohero.com/handbook/glossary/#validity-period): a “not before” and a “not after” date. Chrome compares them with your device’s clock. If the current time is outside that window, for the site’s certificate or for a certificate above it in the chain, Chrome cannot rely on it and stops. The certificate may really be expired, or your clock may be wrong: the error is the same, so check both. Note If you are just visiting a website First check your device’s date, time and time zone. If they are right and only this site fails, the site’s certificate has probably expired: try again later or tell the site owner. Do not enter passwords or payment details. ## Likely causes ### The site’s certificate expired The most common cause, and the site owner’s to fix. Check the dates from any machine with a correct clock: ```bash openssl s_client -connect www.example.com:443 -servername www.example.com /dev/null | openssl x509 -noout -subject -enddate ``` **Fix:** renew the certificate, install it with its full chain, and reload the server (`sudo certbot renew`, then `sudo systemctl reload nginx` for certbot with nginx). Then check every place TLS ends: load balancers, CDNs and Kubernetes ingress controllers often hold their own copy. Public TLS certificates may be valid for at most 200 days since 15 March 2026, and for at most 47 days from 15 March 2029. Renew automatically, for example with ACME, and monitor the expiry date that each endpoint actually serves. ### It was renewed, but the old certificate is still served If the certificate file on the server is new but the error remains, the server or one node behind the load balancer still serves the old one. Compare the file with what is served: ```bash openssl x509 -in /etc/ssl/www.example.com/fullchain.pem -noout -enddate ``` Reload or restart the service, and test each backend directly with `openssl s_client -connect :443 -servername www.example.com`. ### The device’s clock is wrong If many sites fail with this error on one device, its clock is off. Common reasons: a flat motherboard battery, a virtual machine restored from an old snapshot, a device without network time, or a wrong time zone. Check: ```powershell w32tm /query /status w32tm /resync ``` ```bash timedatectl status sudo timedatectl set-ntp true ``` On phones and laptops, turn on “Set time automatically” in the date and time settings. ### An intermediate or old chain expired If the site’s own certificate is valid, look at the other certificates the server sends (`openssl s_client -showcerts`). An expired intermediate or cross-signed certificate left in the chain file must be replaced with the CA’s current chain. Warning Proceeding is not a fix Clicking “Proceed to … (unsafe)” past an expired certificate teaches users to ignore the warning that protects them on the day it is an attack. If you run the site, renew it; if your clock is wrong, fix the clock. ## Check yours *Interactive tool: Certificate decoder (runs in the browser at [/tools/decoder/](https://pkizerotohero.com/tools/decoder/))* Paste the site’s certificate (from the browser’s certificate viewer or `openssl s_client -showcerts`). The decoder shows the validity dates and how many days are left or overdue. ## Learn why - [Anatomy of an X.509 certificate](https://pkizerotohero.com/handbook/x509-certificates/): the validity fields. - [Inventory, expiry and renewal](https://pkizerotohero.com/handbook/certificate-lifecycle/) and [ACME and the 47-day schedule](https://pkizerotohero.com/handbook/acme/). - The same problem in OpenSSL: [verify error:num=10:certificate has expired](https://pkizerotohero.com/errors/openssl-certificate-has-expired/). - See also: Firefox’s [SEC\_ERROR\_EXPIRED\_CERTIFICATE](https://pkizerotohero.com/errors/firefox-sec-error-expired-certificate/). **Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/errors/chrome-err-cert-date-invalid/). Last reviewed 20 October 2026Edition 0.9 ## Learn why it happens - [Chapter 8: Anatomy of an X.509 certificate](https://pkizerotohero.com/handbook/x509-certificates/) - [Chapter 19: Inventory, expiry and renewal](https://pkizerotohero.com/handbook/certificate-lifecycle/) ## Fix it step by step - [How to check when a certificate expires, and monitor it](https://pkizerotohero.com/guides/check-certificate-expiry/) - [How to install a certificate in nginx](https://pkizerotohero.com/guides/install-certificate-nginx/) - [How to install a certificate in Apache httpd](https://pkizerotohero.com/guides/install-certificate-apache/) - [How to install a certificate in IIS](https://pkizerotohero.com/guides/install-certificate-iis/) - [How to get and renew Let's Encrypt certificates with certbot](https://pkizerotohero.com/guides/certbot-lets-encrypt/) - [How to automate certificates in Kubernetes with cert-manager](https://pkizerotohero.com/guides/kubernetes-cert-manager/) - [How to automate certificates on Windows with win-acme](https://pkizerotohero.com/guides/win-acme-windows/) - [How to prepare for short-lived certificates: a checklist](https://pkizerotohero.com/guides/prepare-47-day-certificates/) ## Everything on this topic - [Lifecycle and automation](https://pkizerotohero.com/topics/lifecycle-and-automation/)