SEC_ERROR_EXPIRED_CERTIFICATE

Where you see it

As a full-page warning in Firefox, titled “Warning: Security Risk” in recent versions:

Be careful. Something doesn’t look right.
Firefox spotted a potentially serious security issue with www.example.com. Someone pretending to be the site could try to steal things like credit card info, passwords, or emails.

Under Advanced, Firefox gives the date and your clock’s date:

What makes the site look dangerous?
Sites use certificates issued by a certificate authority to prove they’re really who they say they are. Firefox doesn’t trust this site because it looks like the certificate expired on 4/13/2015.
What can you do about it?
Your device’s clock is set to 10/20/2026. If this is correct, the security issue is probably with the site itself. If it’s wrong, you can change it in your device’s system settings.
...
Error Code: SEC_ERROR_EXPIRED_CERTIFICATE

The texts are in Firefox’s certificate error strings. Related codes: SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE when a CA certificate above the site’s has expired, and MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE when the certificate is not valid yet. Chrome and Edge show the same problem as NET::ERR_CERT_DATE_INVALID.

What it means

Every certificate has a validity period: a “not before” and a “not after” date. Firefox compares them with your device’s clock. Here the current time is after the certificate’s end date, so Firefox will not rely on it, even if everything else about it is correct. The certificate may really have expired, or your clock may be wrong. Firefox prints both dates to help you decide.

Likely causes

The site’s certificate expired

The most common cause, and the site owner’s to fix. Check the dates from any machine with a correct clock:

openssl s_client -connect www.example.com:443 -servername www.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

subject=CN=www.example.com
notBefore=Jan  1 00:00:00 2026 GMT
notAfter=Apr  1 00:00:00 2026 GMT

Fix: renew the certificate, install it with its full chain, and reload the server. With certbot and nginx:

sudo certbot renew
sudo nginx -t && sudo systemctl reload nginx

Public TLS certificates may be valid for at most 200 days since 15 March 2026, and for at most 47 days from 15 March 2029. Automate renewal, for example with ACME, and monitor the date each endpoint actually serves: How to check when a certificate expires, and monitor it.

It was renewed, but the old certificate is still served

If the file on disk is new but Firefox still complains, a service was not reloaded, or a load balancer, CDN or second server still has the old certificate. Compare:

openssl x509 -in /etc/ssl/www.example.com/fullchain.pem -noout -enddate

Reload the service, then test each backend directly with openssl s_client -connect <backend-ip>:443 -servername www.example.com.

Your device’s clock is wrong

If many sites fail at once on one device, check its date, time and time zone. A flat clock battery, a virtual machine restored from an old snapshot, or a device without network time are common reasons.

w32tm /query /status
w32tm /resync

timedatectl status
sudo timedatectl set-ntp true

A clock that runs far enough behind gives the opposite code, MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE.

A CA certificate in the chain expired

If Firefox shows SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE, the site’s own certificate is fine but an intermediate it sends has expired. Look at every certificate with openssl s_client -showcerts, download the CA’s current chain, rebuild the chain file and reload. See How to build the full chain file your server needs.

Check yours

Try it: Certificate decoderOpen the full tool

Runs in your browser. Nothing you paste is sent anywhere.

Paste a certificate

Try a sampleChoose a sample…A website certificate (www.example.com)An expired certificateA wildcard certificate (*.example.com)A certificate with a Common Name but no SANA self-signed root CAA complete chain: leaf, intermediate and root

-----BEGIN CERTIFICATE----- MIIC1jCCAnygAwIBAgIQNPchftz8jn6EE0nYthv4IzAKBggqhkjOPQQDAjB+MQsw CQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UECxMe U2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSswKQYDVQQDEyJQS0kgWmVy byB0byBIZXJvIFNhbXBsZSBJc3N1aW5nIENBMB4XDTI1MTEwMTAwMDAwMFoXDTI2 MDEzMDAwMDAwMFowGjEYMBYGA1UEAxMPd3d3LmV4YW1wbGUuY29tMFkwEwYHKoZI zj0CAQYIKoZIzj0DAQcDQgAEnFxMTbSS6N//zfTxXpHxlwQXb/vUy+GJ0VD/hV2T qh4hwe8YIotO6LTc8gcoN7U/lzWAxB0YGCQNdl3ZkaeNC6OCAT4wggE6MAwGA1Ud EwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMCcG A1UdEQQgMB6CD3d3dy5leGFtcGxlLmNvbYILZXhhbXBsZS5jb20wHQYDVR0OBBYE FLePvyuDFGAE/tNEqDYHGxSlxoD9MB8GA1UdIwQYMBaAFN+ph37v40SN23r6Fg/z OvSNjJqeMEgGCCsGAQUFBwEBBDwwOjA4BggrBgEFBQcwAoYsaHR0cDovL3BraS5l eGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcnQwPQYDVR0fBDYwNDAyoDCg LoYsaHR0cDovL3BraS5leGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcmww EwYDVR0gBAwwCjAIBgZngQwBAgEwCgYIKoZIzj0EAwIDSAAwRQIhAM8HGMZHERBn faVlrjwlVBfFzLIBiMhxHlwupcIdsXYfAiBjweZeZ9ch63PQ3YYp81rY4QHX1y9Q vdp9yJS+yypzgg== -----END CERTIFICATE-----

PEM text, several PEM blocks, or a .pem, .crt, .cer or .der file (drop it on the box). Certificates are public, so they are safe to paste.

DecodeClearChoose a file

Paste the site’s certificate (from View the site’s certificate on the warning page, or from openssl s_client -showcerts). The decoder shows notBefore, notAfter and how many days are left or overdue.

Learn why

• Anatomy of an X.509 certificate: the validity fields.
• Inventory, expiry and renewal and ACME and the 47-day schedule.
• The same problem elsewhere: verify error:num=10 in OpenSSL and CERT_HAS_EXPIRED in Node.js.

In the gameLevel 8: The certificateRoyal Notary, Keystone. In development