What Firefox actually says
The explanation under the heading is short and specific:
The certificate for <host> expired on <date>.The date is the useful part. Compare it to today, and to what your own device thinks today is.
Rule out your clock first
This is the step people skip, and it accounts for a large share of reports.
A certificate is valid between two dates. Your browser decides whether today falls inside that window using your computer's own clock. If the clock is wrong, perfectly good certificates appear expired, or appear not to be valid yet.
Firefox takes this seriously enough to ship a dedicated page for it, titled Your Computer Clock is Wrong. If you see that title rather than a security risk warning, Firefox has already worked it out for you.
The signs are easy to read. If every secure site suddenly fails at once, suspect your clock. If exactly one site fails while everything else works, suspect the site.
Common triggers are a dead motherboard battery on an older desktop, a device that has been switched off for months, a wrong time zone, or a phone that lost automatic time after travelling. Set the date and time to update automatically, then reload.
If your clock is right, the certificate really did expire
Certificates are deliberately short lived. They are not a one time purchase, they are a subscription with a hard cut off, and the browser enforces it to the minute.
The usual reasons a business site lapses:
- →Automatic renewal quietly stopped. A renewal job failed weeks ago and nobody was watching the alerts.
- →It renewed but was never installed. The new certificate exists, and the web server is still serving the old one because it was never reloaded.
- →Renewal notices went to an address nobody reads. An old admin mailbox, or a departed employee.
- →Only one server was updated. Behind a load balancer or a CDN, one stale node fails for some visitors and not others.
- →Renewal was blocked by a redirect or firewall rule that stopped the authority from confirming you still control the domain.
Firefox is not Chrome here
Chrome's equivalent is NET::ERR_CERT_DATE_INVALID, and Chrome splits the clock case out into its own "Your clock is ahead" and "Your clock is behind" pages.
There is also a difference in strictness worth knowing. Firefox uses the Mozilla CA store to verify that a connection is secure, rather than certificates supplied by the user's operating system. Expiry itself is a date check that works the same way in both, but if you fix the expiry and Firefox still complains, that CA store difference is your next suspect. It is covered on our Firefox warning page.
If it is your site, in order
Fast to fix, easy to repeat if you stop at step three.
- 1.Confirm the server date is correct too. A server with a badly wrong clock creates its own strange results.
- 2.Renew or reissue the certificate through your host or your certificate authority.
- 3.Install it and reload the web server. This is the step that gets missed. Until the server reloads, visitors still get the expired one.
- 4.Include the intermediate chain while you are in there, or you may trade this error for SEC_ERROR_UNKNOWN_ISSUER.
- 5.Update every server, node and edge that terminates the connection, not just the first one you found.
- 6.Turn on automatic renewal and expiry alerts so the next one is invisible. Then verify with our free check.
Frequently asked questions
Is an expired certificate dangerous?
The encryption still works, but the verification does not, so your browser can no longer confirm the site is who it claims to be. That is enough reason to stop before logging in or paying. It is usually neglect rather than an attack, but you cannot tell which from the warning page.
How do I know if it is my clock instead?
Check whether other secure sites work. If everything fails at once, your device date and time are the likely cause. Firefox also has a dedicated "Your Computer Clock is Wrong" page, so if you see that title it has already diagnosed it. Set your device to update time automatically and reload.
The certificate renewed, so why does Firefox still say expired?
Because renewing and installing are two different things. Very often the new certificate exists but the web server was never reloaded, so it keeps serving the old one from memory. Reload the server and check again from outside your own network.
Can I just click through until the owner fixes it?
We would not recommend it, and definitely not for anything involving a login or a payment. The warning exists because the identity check failed, and clicking through does not make it pass. Come back when the site loads cleanly.
How long are certificates valid for?
Much less time than people expect, and the industry keeps shortening it. Treat renewal as a scheduled, automated job rather than something you do by hand once a year, because manual renewal is exactly how sites end up on this page.