Fix NET::ERR_CERT_DATE_INVALID in Chrome, Edge, and Firefox

You clicked a link, got the big red "Your connection is not private" screen, and now you're stuck. Annoying. Let's fix it.

The error NET::ERR_CERT_DATE_INVALID means one specific thing: your browser looked at the website's SSL certificate and decided the dates don't line up. Either the cert has expired, or it isn't valid yet, or — and this is the case 90% of the time — your computer thinks it's a different day than it actually is.

The fix: check your system clock first

Before you touch anything in the browser, look at the clock in the bottom-right corner of your screen (Windows) or the top-right menu bar (Mac). If the date or time is off by more than a few minutes, that's your problem.

Windows 10 and 11

1. Right-click the clock in the taskbar.
2. Click Adjust date/time.
3. Turn Set time automatically to On if it's off.
4. Click Sync now.

After clicking Sync now, you should see the clock jump to the correct time within a second or two. If it doesn't, keep reading — there's a manual command below.

macOS Ventura, Sonoma, Sequoia

1. Open System Settings.
2. Go to General > Date & Time.
3. Turn on Set time and date automatically.
4. Make sure the time zone is correct. If you're in New York but it says London, your certs will fail.

Once the clock is right, reload the page with Ctrl+F5 (Windows) or Cmd+Shift+R (Mac) to force a fresh fetch. The warning should be gone.

If the clock is correct, force a time resync at the command line

Sometimes Windows says the time is fine but the underlying service has drifted. Open Command Prompt as Administrator and run:

w32tm /resync /force

You should see: "Sending resync command to local computer... The command completed successfully." If you get "The service has not been started," run this first:

net start w32time
w32tm /resync /force

Reboot after that. I've watched this fix cert errors on machines where the GUI Sync button silently failed.

Why the clock breaks SSL

Every SSL certificate has a Not Before and Not After date. When your browser connects to a site, it compares the cert's valid window against your system time. If your clock says it's 2019 but the cert was issued in 2024, the browser sees a cert that "isn't valid yet" and refuses the connection. That's the whole mechanism. No hack, no malware — just a clock that drifted after a dead CMOS battery, a long power outage, or a VM that's been suspended for months.

Fun fact: this is one of the most common causes of support tickets right after a holiday break, because office PCs that sat powered off for two weeks come back with a CMOS battery that finally gave up.

Less common causes of the same error

• The site's certificate really is expired. If your clock is right and other HTTPS sites load fine, the site owner forgot to renew. Nothing you can do except wait, or contact them. Don't click through unless you trust the site.
• The cert is valid but your timezone is wrong. Rare, but I've seen it — a laptop set to UTC+0 while the user is in California, with a cert that's valid for only a few more hours. Toggle the timezone back to auto.
• Corporate proxy doing SSL inspection. Your IT department's proxy is re-signing certs with its own certificate, and that cert has expired. You'll see this if every HTTPS site fails but HTTP works. Contact IT — you can't fix it from your side.
• BIOS clock reset. A dead CMOS battery resets the BIOS clock to 2010 every boot. Windows syncs and fixes it, but if the machine boots and connects to the network before the time service starts, some apps fail. Replace the CR2032 battery — it's a $2 part.
• Malware tampering with system time. Rare but real. If you keep fixing the clock and it keeps drifting, run a full scan with Malwarebytes and check services.msc for weird startup entries.

What NOT to do

Don't click "Advanced" and then "Proceed to (unsafe)." Don't install a "SSL fix" extension from the Chrome Web Store. Don't disable Windows Time service. And please don't edit your hosts file. None of those actually fix the problem, and the extension one is a common malware vector.

Preventing it from coming back

1. Keep automatic time sync on. Windows, macOS, and Linux all have it. Leave it enabled.
2. Replace a dying CMOS battery. If your PC's clock resets every time you unplug it, that's the battery. On desktops it's a coin cell on the motherboard. On older laptops it's a bit more work, but doable.
3. Set your VM guest additions / tools to sync time with the host. VirtualBox and VMware both have this option. Suspended VMs drift fast.
4. Don't run with your BIOS set to a date 5 years ago because the last OS install failed once. Fix it.

Nine times out of ten, syncing the clock clears this error instantly. If it didn't, you've got a proxy, a real expired cert, or a hardware issue — and now you know which one.