How to fix ERR_CERT_DATE_INVALID
ERR_CERT_DATE_INVALID (shown by Chrome as NET::ERR_CERT_DATE_INVALID) means the browser reached your server, read its certificate, and found today’s date is outside the certificate’s valid window. Either the certificate expired, it is not valid yet, or the device clock is wrong. First find out which, because the fix is different for each.
- Likely cause
- Certificate expired or not-yet-valid, or a wrong device clock
- Severity
- High — the site is a hard block for every visitor
- Time to fix
- About 10 minutes once you know which of the three it is
- Prevention
- Automated renewal plus expiry monitoring
What causes it
- The certificate passed its notAfter date and was never renewed, or renewed on disk but never reloaded by the web server.
- The certificate’s notBefore date is in the future, which happens when a device clock is set ahead or a certificate was issued for a later start.
- The visitor’s own computer or phone has the wrong date, so a valid certificate looks expired to them alone.
How to fix it
1. Read the certificate’s actual dates
Check what window the served certificate claims. Run this against the file on the server, then against the live host to be sure the server is serving what you think it is.
openssl x509 -in cert.pem -noout -dates openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates2. If it expired, renew and reload
Renew the certificate with your ACME client, then reload the web server so it serves the new file. A renewal that only wrote to disk does not take effect until the server reloads.
sudo certbot renew sudo systemctl reload nginx3. If the clock is wrong, correct it
If notBefore is in the future or the visitor sees the error alone, the clock is the problem. Sync the machine to network time.
sudo timedatectl set-ntp true
How to prevent it
Turn on automated renewal and confirm the reload hook runs, then watch the served certificate’s expiry from outside so a stalled renewal reaches you as an alert rather than as a down site.
Source: Chrome certificate error reference
Common questions
Why does only one person see ERR_CERT_DATE_INVALID?
Their device clock is wrong. A certificate valid for everyone else looks expired or not-yet-valid to a machine whose date is off. Correcting the device time clears it.
I renewed the certificate but the error stays. Why?
The web server is still holding the old certificate in memory. Reload or restart the server after renewal, then re-check the live host, not the file on disk.
Fixed it? Catch the next one before your visitors do — monitor the certificate from outside, 3 free, no card.