This error most commonly means the certificate has expired — check its expiry date directly via an SSL checker or OpenSSL. Renew if so.
The less common cause
If the certificate is genuinely still valid, the visitor's own device clock may be significantly wrong, making a valid certificate appear not-yet-valid or already-expired from their device's perspective — this is a client-side issue you can't fix server-side, though it's worth being aware of if support requests about this error don't match your own confirmed certificate status.
How to quickly confirm whether the certificate or your own system clock is the actual problem
Checking the certificate's actual expiry date directly (via a browser's certificate details, or an OpenSSL command) against your system's current date and time distinguishes a genuinely expired certificate from a system clock that's simply set incorrectly, two very different problems producing this identical error message.
Why this error can appear even for a certificate that isn't actually expired yet
If your device's clock is set incorrectly, running significantly fast or slow, or on the wrong date entirely, a perfectly valid, unexpired certificate can trigger this exact error because your system incorrectly believes the current date falls outside the certificate's valid window.
What steps to take if your system clock genuinely is the problem
Checking your operating system's date and time settings, confirming automatic time synchronization is enabled rather than a manually set clock, and manually correcting the date if synchronization isn't working resolves the client-side version of this issue quickly.
What steps to take if the certificate itself really has expired
If independent verification confirms the certificate is genuinely expired, this is a server-side issue requiring the site owner to renew — as a visitor, there's no client-side fix, and continuing to the site despite the warning risks encountering additional problems, since an expired certificate often indicates broader configuration neglect.
Why this error is one of the most common yet most confusing to first-time troubleshooters
The confusion stems from the error message not distinguishing between two entirely different root causes, an actually expired certificate versus an incorrect client clock, requiring the troubleshooter to do their own additional diagnosis to figure out which specific scenario they're actually facing.
A final note for site owners receiving visitor reports
For a site owner receiving reports of this error from visitors, checking your certificate's actual expiry date independently (rather than trusting a dashboard that might be showing cached or delayed information) confirms whether this is a genuine renewal failure requiring immediate action, or whether affected visitors simply have incorrect system clocks on their end.
What a properly automated renewal setup does to prevent this error entirely
A correctly configured ACME client with automated renewal, covered throughout our How-To category, renews certificates well before their actual expiry date with no manual intervention required — sites experiencing this error due to genuine expiry are almost always relying on manual renewal that was simply forgotten or delayed.
How to set up a monitoring safety net specifically for this scenario
Beyond automation itself, a separate, independent monitoring check for certificate expiry provides a safety net catching the specific failure mode where automation itself silently breaks — worth setting up even when you're confident your renewal automation is working correctly.
A quick closing checklist
A quick closing checklist covers verifying the actual expiry date independently, checking your own system clock accuracy, and, if genuinely expired, treating renewal as urgent rather than routine given visitors are actively encountering the warning right now.
What role certificate monitoring plays in preventing this from ever becoming a visitor-facing problem
A properly configured monitoring alert, covered in our dedicated monitoring guide, notifies you well before a certificate's actual expiry, turning this potential visitor-facing error into a routine, proactively handled renewal instead.