NET::ERR_CERT_DATE_INVALID means the browser compared the certificate's validity dates with the current date and they did not match. Either the certificate has expired (most common), it is not valid yet, or the device viewing the site has the wrong date and time.
Before you start
- Check the certificate dates in Chrome: Not secure → Certificate is not valid → Validity period.
- Check your own device's date and time.
Common causes
- Expired certificate – AutoSSL could not renew, or a manual certificate was forgotten.
- Wrong device clock, often after a dead CMOS battery or a manual time zone change.
- An old certificate still served after renewal because of a cache or a CDN with its own copy.
- Outdated devices missing newer root certificates, which can look like a date issue.
How to fix it as a visitor
- Set the date and time automatically in your system settings, then restart the browser.
- Update the operating system and browser to get current root certificates.
- Try another device. If the site works elsewhere, the issue is your device.
How to fix it as the site owner
- Check the certificate status in cPanel → Security → SSL/TLS Status. Expired domains show a red icon.
- Run AutoSSL. Select the domains and click Run AutoSSL. If it fails, read the log and follow AutoSSL not working.
- Renew paid certificates with your provider and install the new one; see renew an expired certificate.
- Check Cloudflare or CDN certificates if you use one; the edge certificate is separate from the origin.
- Check mail services too. Email clients connecting to
mail.example.comuse the same certificate.
Warning: AutoSSL renews automatically, but only if validation keeps working. Moving DNS elsewhere, adding Cloudflare or blocking /.well-known/ silently breaks renewal until the certificate expires.
What to check afterwards
Run echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates and confirm notAfter is in the future.
FAQ
How long are SSL certificates valid?
Public certificates currently last up to about a year, and AutoSSL certificates are shorter and renew automatically.
Why do only some visitors see the error?
Their device clocks are wrong, or they use old devices without updated root certificates.
Will my site go down when the certificate expires?
The site keeps running, but browsers show a full-page warning that drives visitors away.