"Your Connection Is Not Private" on Your Site? Here's the Fix.

If only one visitor sees the error, check their device clock first. A computer set to the wrong date makes valid certificates look expired. If everyone sees it, it's your certificate. Check it with the free SSL certificate checker, or from a terminal:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -dates

notAfter in the past means expired. notBefore in the future means a new certificate was installed early or the server clock is wrong.

Let's Encrypt / certbot: run certbot renew, then reload the web server (systemctl reload nginx or apache2). Renewing without a reload leaves the old certificate in memory, which is a common reason the error sticks around.

Paid certificate: renew with your provider, install the new certificate and its intermediate chain, then reload.

Hosting panel or CDN: look for a "renew" or "reissue" button in the SSL section. Behind Cloudflare, the edge certificate is Cloudflare's job, but your origin certificate is still yours.

Expired certificates on auto-renewing setups usually come down to a renewal job that stopped running, a DNS or firewall change that broke validation, or a cert that was renewed but never reloaded. Check your renewal logs (/var/log/letsencrypt/ for certbot) and test with certbot renew --dry-run.

Public SSL certificates now last at most 200 days (since March 15, 2026), dropping to 100 days in 2027 and 47 days in 2029. Let's Encrypt also stopped sending expiry reminder emails in June 2025. More renewals and no reminder email means more sites will find out from this error. More on the 47-day change.

What does NET::ERR_CERT_DATE_INVALID mean?
The browser checked the website's SSL certificate and the current date is outside its valid period. Usually the certificate has expired. Sometimes the visitor's device clock is wrong.

How do I fix ERR_CERT_DATE_INVALID on my website?
Renew the SSL certificate, install it with its full chain, and reload or restart the web server so it serves the new one. Then find out why automatic renewal failed so it doesn't happen again.

Why do I still see the error after renewing?
The web server is probably still serving the old certificate from memory. Reload it. If you're behind a CDN or load balancer, the certificate may also need updating there. Browser caches can hold onto it briefly too.

How do I know before my certificate expires?
Use a monitor that checks the certificate's expiry date on a schedule and emails you weeks in advance. Let's Encrypt no longer sends those reminders.