Browser errors
SEC_ERROR_EXPIRED_CERTIFICATE: expired cert or wrong clock
SEC_ERROR_EXPIRED_CERTIFICATESEC_ERROR_EXPIRED_CERTIFICATE means the certificate's expiry date has passed according to your device's clock. Either the site forgot to renew, or your computer's clock is ahead. Firefox prints your current date on the warning page, so you can usually tell in seconds.
Is it the site or your device?
Usually the site forgot to renew; a wrong date on the warning page points to your clock. Look at the date Firefox shows on the warning ("your computer clock is set to..."). If it is wrong, fix the clock. If it is right, confirm with the SSL checker:
curl ssl.sh/example.com
- The checker shows the certificate expired: the site must renew. Nothing safe to do on the visitor side.
- The checker shows a valid certificate and your clock is correct: a proxy, antivirus product or captive portal may be presenting its own expired certificate. Check the issuer in the certificate viewer.
Causes
1. Renewal failed or was never deployed
The ACME job broke (DNS changed, port 80 blocked, API token expired) or a manually bought certificate was not replaced. Check the dates:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -enddate
2. Renewed but the server was not reloaded
New files sit on disk while Nginx or Apache still serve the old certificate from memory. Reload the service after every renewal; certbot's --deploy-hook or acme.sh's --reloadcmd does this automatically.
3. Your clock is ahead
A computer whose clock jumped forward (wrong time zone handling, manual change, faulty RTC) sees valid certificates as expired. Turn on automatic time.
4. Expired intermediate in the chain (SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE)
The server bundles an old intermediate. Replace the chain file with the CA's current one, or let the chain builder generate it.
5. Not yet valid (MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE)
The clock is behind, typically after a dead CMOS battery. The fix is the same: set the correct time.
What it looks like in each browser
| Browser | What you see |
|---|---|
| Firefox | "Warning: Potential Security Risk Ahead", text says the certificate expired on a date, with SEC_ERROR_EXPIRED_CERTIFICATE |
| Chrome / Edge | NET::ERR_CERT_DATE_INVALID |
| Safari | "This Connection Is Not Private"; details say the certificate has expired |
| curl | SSL certificate problem: certificate has expired |
How site owners fix it
Renew the certificate, reload the server, and update every copy on CDNs and load balancers.
1. Renew and reload.
sudo certbot renew
sudo systemctl reload nginx
2. Make renewal self-healing. Add a deploy hook so the server always reloads:
sudo certbot renew --deploy-hook "systemctl reload nginx"
3. Update every copy. CDNs, load balancers and mail servers do not pick up files from your origin.
4. Monitor expiry. Check with curl ssl.sh/example.com after each renewal and set an alert well before the date. With 200-day maximum lifetimes in 2026 and shorter ones coming (see validity calculator), automation is the only reliable approach; see automating renewal.
FAQ
Is it safe to accept the risk on an expired certificate?
Not for sites with logins or payments. An expired certificate is usually an oversight, but an attacker holding an old certificate and key would produce the same warning. Wait for the owner to renew.
What is SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE?
An intermediate certificate in the chain has expired, even though the site's own certificate is current. The server is sending an outdated chain file; it must download the CA's current intermediate and replace the bundle.
Firefox says the certificate expired but the expiry date is next week. Why?
Your computer's clock is ahead. Firefox prints the device's current date on the warning page; compare it with the real date and turn on automatic time sync. See wrong system clock.