Fix CERT_E_EXPIRED (0x800B0101) – 3 Steps That Actually Work

What Is CERT_E_EXPIRED (0x800B0101)?

This error pops up when Windows can't trust a certificate because it's expired — either the server's cert or one on your machine. You'll see it in browsers, Outlook, or any app that checks HTTPS. I've seen it trigger when someone visits a site that hasn't renewed their SSL, but more often it's your own system's certificate store acting up. The error code is 0x800B0101, and it's frustrating because it blocks you from secure sites even when the site itself is fine.

Step 1: Check Your Date & Time (30 Seconds)

This is the #1 cause. If your system clock is off by even an hour, Windows thinks the certificate expired early. I've fixed this for more users than I can count — they swore the clock was right, but it was set to the wrong year or time zone.

1. Right-click the clock in the taskbar and select Adjust date/time.
2. Turn on Set time automatically and Set time zone automatically.
3. If they're already on, toggle them off, wait 5 seconds, toggle back on.
4. Manually sync: click Sync now under Additional settings.

Still off? Check your time zone manually. For example, someone in New York set to UTC+5:30 will see this error constantly. After fixing, restart your browser and try the site again.

Step 2: Clear the SSL Certificate Cache (5 Minutes)

If the clock's right, your local certificate store might have a corrupt or stale copy. Windows caches certificates to speed up connections, but that cache can rot. Let's flush it.

1. Press Windows key + R, type inetcpl.cpl, and hit Enter.
2. Go to the Content tab.
3. Under Certificates, click Clear SSL state.
4. Click OK, then close everything.

This wipes the cached certs — don't worry, Windows re-downloads what it needs. I've seen this fix the error for users who updated their system clock but still got the error. Try the URL again. If it works, you're done.

Step 3: Update Root Certificates via Windows Update (15+ Minutes)

If neither worked, your computer is missing a root certificate that's supposed to be trusted. This happens when Windows hasn't gotten the latest update for a while — especially on older builds like Windows 10 version 1809 or earlier. The fix is a manual update.

1. Open Settings > Update & Security > Windows Update.
2. Click Check for updates and install everything available.
3. Restart your PC.

If you're on a corporate network that blocks updates, or you're offline, download and install the Microsoft Update Root Certificate tool manually. Run it as Administrator. It's a small download and updates your local trust store without touching other settings.

Don't want to install a full update? Open a command prompt as admin and run:

certutil -generateSSTFromWU roots.sst
certutil -addstore -f root roots.sst

This pulls the latest root certs from Microsoft's servers directly. I've used this on locked-down machines where Windows Update was blocked, and it saved the day. After either method, reboot and test.

Still Broken? A Few More Things to Try

If you're still stuck, check these edge cases:

• Corporate proxy or antivirus: Some security software intercepts HTTPS and uses its own certs. Try disabling web scanning temporarily or check with your IT team.
• Expired server certificate: Run certutil -urlcache https://example.com in CMD to see if the server's cert is actually expired. If it is, there's nothing you can do — wait for the site owner to fix it.
• Corrupted user profile: Create a new local user account and test. If the error disappears, migrate your data.

I've walked hundreds of people through this. Start with step 1 — 90% of the time that's it. If not, move to step 2, then step 3. You won't need to reinstall Windows or reset your PC. You've got this.