A warning screen reading net::err_cert_date_invalid stops the page before it loads. No malware is involved. Chrome compares the date on your device against the validity window inside the site’s SSL certificate, and that comparison failed. Until it clears, treat the connection as open. Keep passwords and card numbers out of the form.
What net::err_cert_date_invalid Is Telling You
Every HTTPS request starts with an identity check. The browser reads the certificate the server hands over, then measures its start and end dates against the local clock.
Disagreement between those two readings kills the handshake. No encrypted tunnel gets built, so Chrome blocks the page rather than passing your data through in the clear.
Fault sits in one of two places. Your equipment might be off: a drifting clock, stale browser files, or an antivirus tool that intercepts TLS traffic. Or the owner of the site let the certificate lapse.
Is err_cert_date_invalid Your Problem or Theirs?
Open two or three unrelated HTTPS sites before touching anything. The pattern points straight at the source.
| What you see | Probable source | Who repairs it |
|---|---|---|
| Only one site refuses to load | Lapsed certificate on the host | The site owner |
| Many unrelated HTTPS sites refuse | Wrong local date or time | You |
| Wording says “not yet valid” | Device clock reads too early | You |
| Wording says “expired” | Renewal never happened | The site owner |
How to Diagnose err_cert_date_invalid in Chrome
Click the padlock beside the address bar and open the connection details. Three lines matter.
| Line shown | What it tells you |
|---|---|
| Issued To | The paperwork belongs to the domain you typed |
| Issued By | The Certificate Authority that vouched for it |
| Validity Period | Start and finish dates, where the fault usually hides |
Dates that look correct while the warning stays put suggest a chain with a missing link. A partial chain upsets some browsers even when the leaf file is fine.
The Qualys SSL Labs Server Test grades the host from outside and flags chain gaps. On Linux boxes, the trust store itself gets rebuilt with update-ca-certificates, which is worth checking when a private CA is in play.
Server Fixes That Clear err_cert_date_invalid
Ruled out your own hardware? Sort the TLS setup in your hosting account. Certificate lifetimes are capped at 398 days, and some in the industry want that squeezed to 47 days, a shift DigiCert has documented at length.
Manual renewals slip through the cracks at either length. Free files from Let’s Encrypt are handled by Certbot, which renews on its own, though you can force the job when a scheduled attempt fails.
For a commercial file, pay the Certificate Authority for the next term, generate a fresh Certificate Signing Request on the box, and install what comes back.
| Software | File to edit | Settings to change | Command to apply |
|---|---|---|---|
| Nginx | Server block in /etc/nginx/sites-available/ | ssl_certificate, ssl_certificate_key | sudo systemctl reload nginx |
| Apache | /etc/apache2/sites-available/ on Debian, /etc/httpd/conf.d/ on RedHat | SSLCertificateFile, SSLCertificateKeyFile | sudo systemctl reload apache2 |
Skip the reload and the warning lingers despite a valid file sitting on disk. The systemctl reference covers the difference between a reload and a full restart. Managed hosting panels handle the whole step behind a button.
Internal networks, developer machines, and staging boxes are a separate case. A self-signed file built with make-ssl-cert suits them fine, since you can grant trust by hand.
Device Clock and Cached Data Repairs
Certificate current, warning still reaching visitors? Look at their machines. One day of drift pushes the reading outside the validity window. Flat batteries and travel across time zones cause it constantly.
Windows users right-click the taskbar clock, choose Adjust date/time, and switch automatic time on. Mac users open System Settings, then General, then Date & Time. On Linux, check the current reading with the date command before changing anything.
Systemd machines control synchronisation through timedatectl, which pulls the correct moment from a network time source.
Browsers also cling to details about the old file, so clear stored pages and cookies. Still stuck on Windows? Empty the system SSL store through Internet Options, then Content, then Clear SSL state.
Keeping err_cert_date_invalid Away for Good
Certbot normally builds a scheduled job while issuing your first file. Never assume it works. The timing lives in cron tables, where the entry runs certbot renew and refreshes only files inside 30 days of finishing.
No such entry? Write one, then run certbot renew --dry-run a few days later. It rehearses the job and changes nothing.
Commercial files sell as subscriptions with automatic renewal switched on, which settles the billing. The new file still has to reach your server. Expiry alerts and APIs wired into deployment pipelines remove that last manual gap.
FAQs
What does net::err_cert_date_invalid mean?
It means the browser found a date mismatch during the certificate check. Either the certificate has expired, its start date sits in the future, or the device clock is set wrong.
Is err_cert_date_invalid a virus, as some Reddit threads suggest?
No. Reddit posts often assume infection, but the error is a date check failing. Malware is not involved. An expired certificate or a wrong system clock explains almost every case.
Can I bypass err_cert_date_invalid safely?
Clicking through works, but nothing then proves the connection is private. Read-only browsing carries limited risk. Never enter passwords, card numbers, or personal details on a page behind that warning.
Why do SSL certificates expire at all?
The finish date forces regular re-checking of the identity details tied to your domain. Short lifetimes also limit the damage a stolen key can do, since the file dies sooner.
Only one site shows the error, so what do Reddit users recommend?
Reddit consensus points at the host, not your machine. Test the domain from another network, then email the owner with a screenshot. Only they can renew the certificate.
