RegisterLogin
Web Security & SSL

How to Fix NET::ERR_CERT_DATE_INVALID and Auto-Renew SSL Certificates

A technical guide to diagnosing expired SSL certificates, fixing the NET::ERR_CERT_DATE_INVALID error, and configuring Certbot to automatically renew Let's Encrypt certificates.

Nextgen DevOps Team•
How to Fix NET::ERR_CERT_DATE_INVALID and Auto-Renew SSL Certificates

Seeing a massive, red “Your connection is not private” warning screen when visiting your website is devastating for user trust and SEO. Specifically, the NET::ERR_CERT_DATE_INVALID error means exactly what it sounds like: your SSL certificate has expired.

In the modern web, where Let’s Encrypt provides free SSL certificates that expire every 90 days, setting up an automated renewal pipeline is mandatory. Here is how to fix the error immediately and prevent it from ever happening again.

1. Immediate Fix: Manually Renewing the Certificate

If your site is currently displaying the error, you need to manually force a renewal. The exact command depends on your web server architecture.

If you are using a standard Ubuntu VPS with Certbot installed for Nginx or Apache, SSH into your server (see our SSH Connection Guide if you need help connecting) and run:

sudo certbot renew --force-renewal

Once the certificate is successfully renewed, you must restart your web server to apply the new cryptographic keys:

# For Nginx
sudo systemctl restart nginx

# For Apache
sudo systemctl restart apache2

Refresh your website in an incognito window, and the green padlock should be restored.

2. Why Did It Expire? (Diagnosing the Root Cause)

Certbot is designed to automatically renew certificates before they expire. If it failed, one of three things usually happened:

  1. The Cron Job is Missing: Certbot installs a cron job or systemd timer by default, but it may have been accidentally deleted or disabled.
  2. Firewall Blocking Port 80: Let’s Encrypt uses the HTTP-01 challenge to verify domain ownership, which requires port 80 to be open. If you recently tightened your firewall (a common issue discussed in our 503 Error Troubleshooting Guide where strict UFW rules block HTTP), the renewal will fail.
  3. DNS Changes: If you recently moved your site behind a CDN like Cloudflare without updating your SSL configuration, the Let’s Encrypt server cannot reach your origin server to verify ownership.

3. Automating the Renewal Process

To ensure you never face this error again, verify that the automated timer is active.

Check the status of the systemd timer:

sudo systemctl status certbot.timer

If it is inactive, enable and start it:

sudo systemctl enable certbot.timer
sudo systemctl start certbot.timer

You can simulate a renewal run to ensure there are no hidden errors without actually requesting a new certificate by using the --dry-run flag:

sudo certbot renew --dry-run

If this command succeeds, your automated pipeline is functioning correctly.

Conclusion

The NET::ERR_CERT_DATE_INVALID error is highly visible but incredibly easy to fix. By ensuring Port 80 remains open for HTTP-01 challenges and verifying your systemd timers, you can fully automate your SSL infrastructure and guarantee a secure, warning-free experience for your users.

Eliminate SSL handshaking errors by deploying on Nextgen’s local Pakistan VPS servers.