Your connection is not private: NET::ERR_CERT_DATE_INVALID fix

Read the error code first

The code under the warning tells you which check failed. In Chrome, click the code or "Advanced" to see it. The common ones:

• NET::ERR_CERT_DATE_INVALID (Firefox: SEC_ERROR_EXPIRED_CERTIFICATE): the certificate has expired or is not valid yet, or the device's clock is wrong.
• NET::ERR_CERT_COMMON_NAME_INVALID (Firefox: SSL_ERROR_BAD_CERT_DOMAIN): the certificate is valid but issued for a different name than the one in the address bar.
• NET::ERR_CERT_AUTHORITY_INVALID (Firefox: SEC_ERROR_UNKNOWN_ISSUER): the browser cannot trace the certificate to a trusted authority. Causes include a self-signed certificate, a missing intermediate certificate, or software intercepting the connection.
• NET::ERR_CERT_REVOKED: the issuing authority has withdrawn the certificate, typically after a key compromise or a mis-issuance. It needs replacing, not bypassing.

Expired certificate (NET::ERR_CERT_DATE_INVALID)

Every certificate has a fixed end date. Let's Encrypt certificates currently last 90 days. Under the CA/Browser Forum's ballot SC-081, publicly trusted certificates issued since 15 March 2026 can be valid for at most 200 days, a cap that drops to 100 days in March 2027 and 47 days in March 2029. Shorter lifetimes make renewal automation essential rather than optional.

The fix is to renew or reissue the certificate: through the hosting control panel, through the certificate authority for a purchased certificate, or with the ACME client on a self-managed server (for example, certbot renew). Reload the web server afterward so it serves the new certificate. If renewal was supposed to be automatic, find out why it failed: a renewal job lost in a server migration, a DNS change that broke domain validation, or a firewall or redirect blocking the validation path.

The same code appears when a certificate is not valid yet. That is rare on the server side, but common on devices whose clock has fallen behind, for example after a dead motherboard battery or a long time switched off. If one device shows the error for a certificate that other devices accept, check that device's clock first.

The SSL certificate checker shows the expiry date and a countdown, which makes it easy to confirm the new certificate is live and to see how much time is left before the next renewal.

Wrong name (NET::ERR_CERT_COMMON_NAME_INVALID)

A certificate lists the exact hostnames it covers in its Subject Alternative Name field. If a visitor types www.example.com and the certificate only lists example.com, the browser rejects it, even though both names are the same site to a human.

Wildcards have limits too. A certificate for *.example.com covers shop.example.com but not example.com itself and not deeper names such as a.b.example.com.

On shared hosting and behind load balancers, this error often means the server is presenting a default certificate, such as one issued for the server's own hostname, because no certificate is configured for the requested name. Issue a certificate that lists every name visitors use. The SSL checker reports whether the certificate covers both the www and apex versions of the domain.

A redirect does not get around this. If www.example.com redirects to example.com, the browser still has to complete a secure connection to www.example.com before it can receive the redirect, so the certificate must cover both names even when one of them only ever redirects.

Incomplete chain (NET::ERR_CERT_AUTHORITY_INVALID)

Browsers trust a small set of root certificates. Your certificate is signed by an intermediate certificate, which is signed by a root. The server is expected to send your certificate together with the intermediate, so the browser can build the full chain.

If the server sends only its own certificate, results become inconsistent. Many desktop browsers can fetch or already hold the missing intermediate and show the site normally, while other clients, including command-line tools, payment webhooks, many mobile apps and some mobile browsers, fail with an unknown-issuer error. A site that works for you and fails for some visitors is the classic symptom.

The fix is configuration, not a new certificate. With certbot, point the server at fullchain.pem rather than cert.pem. In nginx, ssl_certificate must contain the certificate followed by the intermediates. In Apache 2.4.8 and later, SSLCertificateFile can hold the full chain. The SSL checker detects a missing intermediate, so you can confirm the fix from outside.

When the problem is the visitor's device

If the SSL checker reports a valid certificate with a complete chain, yet one device still shows the warning, the cause is local. Check these:

• The clock. A device set to the wrong date sees valid certificates as expired or not yet valid. Chrome often says "Your clock is behind" or "Your clock is ahead". Turn on automatic date and time.
• Public Wi-Fi login pages. Hotel, airport and café networks intercept connections until you sign in. Open a plain http:// page to trigger the login screen, then retry.
• Security software or a workplace network that inspects HTTPS. It replaces site certificates with its own, which fails with an authority error unless its root is installed on the device.
• An outdated device. Very old operating systems may lack the root certificates that newer certificate authorities use, so they distrust certificates that current devices accept.

Should you click "Proceed" anyway?

For visitors: avoid it on any site where you log in, pay or enter personal details, because the warning exists to catch impersonation. On sites that use HSTS (HTTP Strict Transport Security), browsers remove the bypass option entirely, so the site is unreachable until the owner fixes the certificate.

For site owners, that last point is why certificate errors are outages, not cosmetic problems. Most visitors leave at the warning page, and API clients and integrations fail outright. Monitor expiry independently of your renewal automation so a silent failure surfaces weeks before the deadline instead of on the day.