> Fix SEC_ERROR_EXPIRED_CERTIFICATE in Firefox: tell an expired certificate from a wrong clock, then renew, install and reload it, or correct the time. Source: https://pkizerotohero.com/errors/firefox-sec-error-expired-certificate/ · Last reviewed: 2026-10-20 - Firefox - Exact text checked with the real tool # SEC\_ERROR\_EXPIRED\_CERTIFICATE Also seen in: Thunderbird, other NSS-based applications **In one sentence:** The site's certificate is past its end date by your device's clock: the owner did not renew it in time, the new one never loaded, or your clock is wrong. [Check yours: Certificate decoder](https://pkizerotohero.com/tools/decoder/) ## Where you see it As a full-page warning in Firefox, titled “Warning: Security Risk” in recent versions: ```text Be careful. Something doesn’t look right. Firefox spotted a potentially serious security issue with www.example.com. Someone pretending to be the site could try to steal things like credit card info, passwords, or emails. ``` Under **Advanced**, Firefox gives the date and your clock’s date: ```text What makes the site look dangerous? Sites use certificates issued by a certificate authority to prove they’re really who they say they are. Firefox doesn’t trust this site because it looks like the certificate expired on 4/13/2015. What can you do about it? Your device’s clock is set to 10/20/2026. If this is correct, the security issue is probably with the site itself. If it’s wrong, you can change it in your device’s system settings. ... Error Code: SEC_ERROR_EXPIRED_CERTIFICATE ``` The texts are in Firefox’s [certificate error strings](https://searchfox.org/firefox-main/source/toolkit/locales/en-US/toolkit/neterror/certError.ftl). Related codes: `SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE` when a CA certificate above the site’s has expired, and `MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE` when the certificate is not valid yet. Chrome and Edge show the same problem as [NET::ERR\_CERT\_DATE\_INVALID](https://pkizerotohero.com/errors/chrome-err-cert-date-invalid/). ## What it means Every certificate has a [validity period](https://pkizerotohero.com/handbook/glossary/#validity-period): a “not before” and a “not after” date. Firefox compares them with your device’s clock. Here the current time is after the certificate’s end date, so Firefox will not rely on it, even if everything else about it is correct. The certificate may really have expired, or your clock may be wrong. Firefox prints both dates to help you decide. Note If you are just visiting a website Look at the two dates on the warning. If your device’s date is wrong, correct it (turn on automatic time). If your date is right, the site’s certificate has expired: try again later or tell the site owner. Do not enter passwords or payment details. ## Likely causes ### The site’s certificate expired The most common cause, and the site owner’s to fix. Check the dates from any machine with a correct clock: ```bash openssl s_client -connect www.example.com:443 -servername www.example.com /dev/null | openssl x509 -noout -subject -dates ``` ```text subject=CN=www.example.com notBefore=Jan 1 00:00:00 2026 GMT notAfter=Apr 1 00:00:00 2026 GMT ``` **Fix:** renew the certificate, install it with its full chain, and reload the server. With certbot and nginx: ```bash sudo certbot renew sudo nginx -t && sudo systemctl reload nginx ``` Public TLS certificates may be valid for at most 200 days since 15 March 2026, and for at most 47 days from 15 March 2029. Automate renewal, for example with ACME, and monitor the date each endpoint actually serves: [How to check when a certificate expires, and monitor it](https://pkizerotohero.com/guides/check-certificate-expiry/). ### It was renewed, but the old certificate is still served If the file on disk is new but Firefox still complains, a service was not reloaded, or a load balancer, CDN or second server still has the old certificate. Compare: ```bash openssl x509 -in /etc/ssl/www.example.com/fullchain.pem -noout -enddate ``` Reload the service, then test each backend directly with `openssl s_client -connect :443 -servername www.example.com`. ### Your device’s clock is wrong If many sites fail at once on one device, check its date, time and time zone. A flat clock battery, a virtual machine restored from an old snapshot, or a device without network time are common reasons. ```powershell w32tm /query /status w32tm /resync ``` ```bash timedatectl status sudo timedatectl set-ntp true ``` A clock that runs far enough behind gives the opposite code, `MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE`. ### A CA certificate in the chain expired If Firefox shows `SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE`, the site’s own certificate is fine but an intermediate it sends has expired. Look at every certificate with `openssl s_client -showcerts`, download the CA’s current chain, rebuild the chain file and reload. See [How to build the full chain file your server needs](https://pkizerotohero.com/guides/build-fullchain/). Warning Proceeding is not a fix “Proceed to … (Risky)” adds an exception for this certificate. It teaches people to click through the warning that protects them on the day it really is an attack. If you run the site, renew the certificate; if your clock is wrong, fix the clock. ## Check yours *Interactive tool: Certificate decoder (runs in the browser at [/tools/decoder/](https://pkizerotohero.com/tools/decoder/))* Paste the site’s certificate (from **View the site’s certificate** on the warning page, or from `openssl s_client -showcerts`). The decoder shows `notBefore`, `notAfter` and how many days are left or overdue. ## Learn why - [Anatomy of an X.509 certificate](https://pkizerotohero.com/handbook/x509-certificates/): the validity fields. - [Inventory, expiry and renewal](https://pkizerotohero.com/handbook/certificate-lifecycle/) and [ACME and the 47-day schedule](https://pkizerotohero.com/handbook/acme/). - The same problem elsewhere: [verify error:num=10](https://pkizerotohero.com/errors/openssl-certificate-has-expired/) in OpenSSL and [CERT\_HAS\_EXPIRED](https://pkizerotohero.com/errors/node-cert-has-expired/) in Node.js. **Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/errors/firefox-sec-error-expired-certificate/). Last reviewed 20 October 2026Edition 0.9 ## Learn why it happens - [Chapter 8: Anatomy of an X.509 certificate](https://pkizerotohero.com/handbook/x509-certificates/) - [Chapter 19: Inventory, expiry and renewal](https://pkizerotohero.com/handbook/certificate-lifecycle/) ## Everything on this topic - [Lifecycle and automation](https://pkizerotohero.com/topics/lifecycle-and-automation/)