Chrome shows err_cert_date_invalid when a site’s SSL/TLS certificate fails its date check. The file has expired, isn’t active yet, or the clock reading it is wrong.

For site owners, the cost shows up fast. Visitors hit a red “Your connection is not private” page, and many leave for good. Most cases trace back to a missed renewal, and 2026’s shorter certificate lifetimes make that easier to miss.

What err_cert_date_invalid means in Chrome

NET::ERR_CERT_DATE_INVALID is Chrome’s code for a certificate whose dates don’t match the current time. Edge shows the same code, since it runs on Chromium.

Every certificate carries two dates: Not Before and Not After. If today falls outside that window, Chrome blocks the page to protect passwords, card numbers and other data in transit.

Certificate Authorities (CAs) such as Let’s Encrypt, DigiCert and Sectigo issue these files after confirming you control the domain. Some types also require company checks.

Date faults are one of several certificate errors. A hostname mismatch triggers the err_cert_common_name_invalid warning instead, and that fix path is different.

Why err_cert_date_invalid shows up more after March 15, 2026

Certificates now expire faster. The CA/Browser Forum approved Ballot SC-081v3 in April 2025 with 29 votes in favor and none against. It cuts the maximum lifetime of public TLS certificates in four stages.

A 200-day certificate issued on March 15, 2026 runs out around October 1, 2026. Sectigo reported in September 2026 that the first wave of 200-day renewals was already landing on IT teams.

Sites that renewed once a year must now renew about twice a year. At 47 days, calendar reminders stop being a workable plan.

What causes the err_cert_date_invalid error?

The first five sit on your side. Visitor-side causes get their own section further down.

How to fix err_cert_date_invalid on your website

Step 1: Check the certificate’s validity dates

Click the icon left of the address bar and open the certificate details. Compare the Not Before and Not After dates with today’s date.

An online SSL checker gives a second view from outside your network. It also flags missing intermediate files in the same pass.

Step 2: Renew or reinstall the certificate

If the date has passed, renew through your CA or hosting panel. Most hosts offer one-click or scheduled renewal.

Install the full chain, not just your own file. A half-finished install produces the same warning, even with fresh dates.

Step 3: Confirm your A and CNAME records

Each certificate covers named hostnames. If an A or CNAME record still points to an old server, visitors land on a machine with an expired file.

Review records at your registrar or DNS host. Testing through Google Public DNS (8.8.8.8 or 8.8.4.4) rules out a stale local resolver.

Step 4: Sync the server clock with NTP

A server clock set in the past makes a brand-new certificate look inactive. Set the correct date, time and zone, then turn on NTP (Network Time Protocol) so drift doesn’t return.

Step 5: Review firewall, proxy and CDN TLS settings

A WAF, reverse proxy or CDN often serves its own edge certificate in front of yours. If that edge file lapses, Chrome throws the error even when your origin server is fine.

Cloudflare users should check edge certificate status and the SSL/TLS mode. Sites running HTTP/3 may hit a separate QUIC protocol fault in Chrome when a firewall filters UDP.

Step 6: Scan for injected code and redirects

Injected scripts and rogue redirects can send visitors to hosts with bad certificates. Run a malware scan and remove unknown redirects before blaming the certificate.

When the visitor’s device triggers err_cert_date_invalid

If your certificate checks out, the fault may sit with the visitor. A laptop with a dead CMOS battery or a manual clock can read a valid certificate as expired.

Antivirus tools that scan HTTPS swap in their own certificate. Old systems such as Windows 7 may also lack current root certificates.

Public Wi-Fi login portals intercept HTTPS until the visitor signs in. People switching between Wi-Fi and mobile data mid-load may see Chrome’s network-changed error instead.

Office proxies can break connections too, and a failed proxy tunnel appears as err_tunnel_connection_failed. You can’t repair these devices, but spotting the pattern speeds up support replies.

err_cert_date_invalid still showing after renewal?

Missing intermediate certificates

A renewed certificate without its intermediates still fails. Depending on the gap, Chrome may report it as a date fault or as a certificate authority trust error.

Old TLS versions

Turn off TLS 1.0 and 1.1, and keep 1.2 and 1.3 active. Handshake failures after that change point to an SSL protocol error rather than a date problem.

Reinstall on your platform

Preventing err_cert_date_invalid before the 100-day limit in 2027

Turn on auto-renewal. Nearly every CA and host includes it now, and ACME clients such as Certbot renew and install without manual steps.

Add expiry monitoring with alerts at 30 days and again at 7 days. A second alert catches renewals that fail without warning.

Keep your CMS, plugins and server packages patched. Old releases can break TLS settings or open holes that let attackers tamper with certificate files.

From March 15, 2029, certificates will last 47 days at most. Any manual step in that process becomes a failure point.

FAQs