Fix a certificate that is not valid yet

Why it matters

Browsers reject a certificate before its start date and show a full-page security warning. This is usually a certificate created on a machine whose clock was ahead (self-signed or internal CA), or a certificate for a later switch that was installed early.

The fix

1. Check the clock of the machine that created the certificate. If it was set to a future date, the certificate carries that date as its start. For a public-CA certificate, also check that the installed file is the one you expect, since an old or wrongly named file is another common cause.
2. Fix the clock and enable time synchronisation (NTP) so it stays right.
3. Request a fresh certificate from your CA or ACME client once the clock is correct, install it and reload the web server.
4. If the date is wrong on purpose (a certificate issued ahead of a planned switch), install the currently valid certificate until the new one starts.
5. Confirm the start and end dates with the command below.

date -u
timedatectl set-ntp true
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Renew the expired TLS certificate
• Renew the certificate before it expires
• Install a certificate that covers this hostname
• Replace the self-signed certificate with a trusted one
• Use a certificate from a publicly trusted authority
• Serve the full certificate chain
• Replace the expired intermediate certificate
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash
• Fix the certificate that browsers reject