NET::ERR_CERT_DATE_INVALID: What It Means & How to Fix It

What Is NET::ERR_CERT_DATE_INVALID?

Every HTTPS certificate is valid between two dates: valid from and valid until. When you open a site, your browser compares those dates with your device's clock. If the clock says today is outside that window, Chrome, Edge and other Chromium browsers stop with NET::ERR_CERT_DATE_INVALID.

Chromium's source code defines it as error -201: "The server responded with a certificate that, by our clock, appears to either not yet be valid or to have expired." It lists three possible reasons: an attacker "presenting an old certificate for which they have managed to obtain the private key", a server that "is misconfigured and is not presenting a valid cert", or "Our clock is wrong." (Chromium)

In practice it is almost always the second or the third: an expired certificate on the site, or a wrong date on your device.

How It Looks in Each Browser

The words change between browsers, but they report the same date check failing.

When Chrome can tell your clock is the problem, it says so instead: "A private connection to … can't be established because your computer's date and time … are incorrect." (Chromium) Our guide to "Your connection is not private" covers the same page's other causes.

Is It Your Clock or the Site?

One question decides it: does every HTTPS site fail, or just this one?

If every site fails, your device's date or time is wrong. Chrome explains why that breaks everything: "the certificates that websites use to identify themselves are only valid for specific periods of time. Since your device's clock is incorrect, Chrome cannot verify these certificates."

If only one site fails, look at its certificate from outside your device. Enter the site below: the check shows the certificate's valid-from and valid-until dates as the server sends them, and how many days are left.

How to Fix It on Your Device

Work through these when the error shows on every site, or when the checker says the site's certificate is fine.

1. Windows: set the time automaticallySelect Start > Settings > Time & language > Date & time and make sure Set time automatically is turned On (Microsoft's own steps). Check the time zone on the same page.
2. iPhone and iPad: fix the date in SettingsChrome's own message on iOS says to "adjust the date and time from the General section of the Settings app". Turning on automatic date and time there keeps it right.
3. Other devicesOpen the system's date and time settings and let it set the time automatically from the network.
4. Update the browser and the systemAn old device can fail on certificates that are fine elsewhere, because a certificate higher up the chain expired and the device doesn't know the newer one (below).
5. Reload the pageAfter fixing the clock, reload. If only one site still fails, check it again with the SSL Checker.

If You Run the Website

If visitors see this error on your site, your certificate (or one in its chain) has expired. Renew it, install it, and make sure every server that answers for your name sends the new one: check from outside with the SSL Checker or paste the certificate into the Certificate Decoder to read its exact dates.

Certificates are getting shorter, so a missed renewal shows up faster than it used to. The CA/Browser Forum's Baseline Requirements cap a publicly trusted certificate's validity by its issue date:

Let's Encrypt's default certificates last 90 days, and it recommends "renewing 90 day certificates every 60 days". (Let's Encrypt) From 10 February 2027 its default lifetime drops to 64 days. (Let's Encrypt) At these lengths, renewal has to be automatic: an ACME client renews on its own, and ACME Renewal Information (RFC 9773) lets the certificate authority tell it when.

An expired intermediate certificate causes the same error, which Firefox names SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE. Send the current chain your certificate authority gives you; what an SSL certificate chain is explains how it fits together.