NET::ERR_CERT_DATE_INVALID: expired certificate or wrong clock?

NET::ERR_CERT_DATE_INVALID (“Your connection is not private”) means the site's certificate isn't valid right now, according to your device's clock. Either the certificate has expired, or your clock is wrong. Firefox shows the same problem as SEC_ERROR_EXPIRED_CERTIFICATE.

First: is it the site or your clock?

If every HTTPS site shows this error, it's your device. A computer with a dead clock battery, or a phone set to the wrong date, sees every certificate as expired or not yet valid. Turn on automatic date and time, and the error goes away.

If it's only one site, check its certificate from outside:

For site owners: renew, then reload

If the checker shows an expired certificate, renew it and make sure the web server actually loads the new one:

sudo certbot renew
sudo systemctl reload nginx          # the step most often forgotten
sudo certbot certificates            # confirm the new expiry

Renewed, but still expired?

• Not reloaded. The server still serves the old certificate from memory. Reload or restart it.
• A different copy. A load balancer, CDN or second server has its own certificate that wasn't updated.
• A different server. DNS points somewhere other than the machine you renewed on.

“Not yet valid”

Rarer, but it happens: a brand-new certificate on a server whose clock is behind, or visitors with clocks set in the past. Check the server clock with timedatectl and make sure NTP is on.

Never be surprised by it

An expired certificate is entirely predictable, yet it still takes sites down. Spot Downtime reads the expiry date on every HTTPS check and warns you 14 days ahead, with SSL monitoring included on every website monitor.