NET::ERR_CERT_DATE_INVALID Explained

Check your clock first. Here is why.

A certificate is valid between two fixed dates. Your browser decides whether that window has passed by looking at your device clock. So if the clock is wrong, the browser reaches the wrong conclusion.

Set a laptop to next year and every site on the internet looks expired. Set it to last year and certificates look like they have not started yet. Either way you get the same code.

This happens more than people expect. A dead motherboard battery in an older desktop, a phone that lost its network time, a device that has been switched off in a drawer for a year, a virtual machine that drifted. It is common enough that Chrome has separate wording for it.

Chrome tells you when it suspects your device

When Chrome believes your clock is the problem, it replaces the usual "Your connection is not private" heading with one of these:

Your clock is ahead
Your clock is behind

These only appear on date related certificate errors. If you see either one, do not touch the site. Fix your device date and time, then reload.

How to fix your device clock

The goal in every case is the same: turn on automatic time so the device syncs with a time server, and make sure the time zone is right too.

1.Windows. Settings, then Time & language, then Date & time. Turn on "Set time automatically" and "Set time zone automatically", then click "Sync now".
2.macOS. System Settings, then General, then Date & Time. Turn on "Set time and date automatically".
3.iPhone or iPad. Settings, then General, then Date & Time. Turn on "Set Automatically".
4.Android. Settings, then System, then Date & time. Turn on automatic date and time from the network.
5.Then reload the page. If the warning disappears, that was it. If it is still there, the certificate really has expired and the rest of this page applies.

What Chrome shows when the certificate really is expired

With a correct clock, you get the standard certificate warning. The heading is "Your connection is not private" and the paragraph is:

Attackers might be trying to steal your information from <SITE>
(for example, passwords, messages, or credit cards).

NET::ERR_CERT_DATE_INVALID

The code appears after you click "Advanced". The buttons are "Back to safety" and, on this error, a "Proceed to <SITE> (unsafe)" link. The proceed option exists here, but see below before using it.

Why certificates expire, and why it happens to real businesses

Certificates are deliberately short lived. Most now last months, not years, so that a stolen key cannot be useful for long. That means renewal is a routine job, and routine jobs get missed.

→Automatic renewal broke quietly. The renewal service stopped, a validation check started failing, or a server move left the renewal script behind. Nobody notices until the day it lapses.
→Renewed but not installed. The new certificate was issued but never deployed, or the web server was never reloaded, so it keeps serving the old one.
→Only some servers updated. Behind a load balancer or a CDN, one node can still hold the expired certificate, which is why the error looks intermittent.
→The wrong certificate is being served. A second site or hostname on the same server can end up answering with an old certificate.
→The business simply closed or moved on. If a shop's certificate expired a long time ago and nothing else has been updated, treat that as a warning in itself.

Can you just click through?

On this error Chrome does give you the option, under Advanced. We would not use it on a shop.

An expired certificate is usually harmless neglect, but the browser genuinely cannot verify who is on the other end any more, and it cannot tell the difference between a lapsed renewal and someone impersonating the site. If you would type a password or a card number, do not proceed. Contact the business another way instead.

Our engine reports the precise reason behind an error like this, including whether the certificate has expired, is self signed, or does not match the website address, so you can find out without loading the site at all.

Frequently asked questions

How do I know if it is my clock or the site?

Try the same site on another device, ideally a phone on mobile data. If it loads fine there, your first device has the wrong date or a local problem. If every device shows the same warning, the certificate really has expired. Chrome also hints at it directly: the headings "Your clock is ahead" and "Your clock is behind" mean Chrome thinks your device is at fault.

Every website is giving me this error. What is going on?

That pattern is almost always a wrong device clock. A certificate cannot expire on every site at once, but a wrong date makes every certificate look invalid. Turn on automatic date and time, check the time zone, and reload.

Is an expired certificate dangerous?

The data you send is still encrypted, but the identity of the site is no longer verified, and that is half the point of a certificate. In practice it usually means the owner missed a renewal. Treat it as a reason not to enter anything sensitive until it is fixed, rather than proof of an attack.

I renewed the certificate but the error is still showing. Why?

Almost always because the new certificate is not actually being served yet. Reload or restart the web server so it picks up the new file, check every server and CDN edge if you have more than one, and confirm you installed it for the right hostname. Running a check from outside your network tells you what visitors are really getting.

Why do certificates only last a few months now?

Shorter lifetimes limit the damage if a private key is ever stolen, because the certificate stops being usable sooner. The trade off is that renewal has to be automated. If you are still renewing by hand once a year, this error is going to keep coming back.