SEC_ERROR_EXPIRED_CERTIFICATE in Firefox: Causes and Fixes

SEC_ERROR_EXPIRED_CERTIFICATE is the error code Firefox shows on its "Warning: Potential Security Risk Ahead" page when a certificate it was given has passed its end date. Click Advanced and Firefox displays text such as "The certificate expired on [date]. The current time is [date]." That wording is helpful because it shows both the expiry date and the time your device believes it is.

Chrome and Edge report the same situation as ERR_CERT_DATE_INVALID. This page focuses on what is specific to Firefox: its own certificate store, its handling of intermediates, and the related codes that appear when the expired certificate is not the one you expect.

Related Firefox codes

"Not yet valid" almost always means the client's clock is behind, or a certificate was issued with a future start time.

If you are a visitor

1. Read the dates under Advanced. If the "current time" Firefox shows is wrong, fix your system clock and time zone, then restart Firefox.
2. Check another browser or another device. If Chrome shows an expiry error too, the site's certificate really expired. If only Firefox fails, continue below.
3. Update Firefox. Firefox updates its list of trusted roots and intermediate certificates with each release. Open Settings, General, Firefox Updates.
4. Disable security software that inspects HTTPS. Under Settings, Privacy and Security, Certificates, View Certificates, Authorities, you can see whether a security product added its own root. Outdated or expired local roots from antivirus tools produce this error for every site.
5. Restart in Troubleshoot Mode from Help, Troubleshoot Mode to test without add-ons.
6. Do not click "Accept the Risk and Continue" on sites with accounts or payments. Firefox offers it only when the site does not enforce HSTS. For HSTS sites, the button is absent and you must wait for the owner to renew; check the policy with the HSTS Checker.
7. Tell the site's owner. Include the page, date and the dates shown under Advanced.

If you own the site

1. Check every certificate in the chain, not just the leaf

Firefox can show this error when the leaf is current but an intermediate you send has expired. Print each certificate's end date:

echo | openssl s_client -connect example.com:443 -servername example.com -showcerts 2>/dev/null \
 | awk '/BEGIN CERT/{i++} {print > "cert" i ".pem"}'
for f in cert*.pem; do openssl x509 -in "$f" -noout -subject -enddate 2>/dev/null; done

The SSL Chain Debugger shows the same chain with dates and flags the expired element. Replace expired intermediates in your bundle with the current ones from your CA.

2. Renewal succeeded but the server still serves the old file

Common after an automated renewal: the new certificate is on disk, but the web server was never reloaded, or a second server or load balancer node still has the old one.

sudo certbot certificates
sudo nginx -t && sudo systemctl reload nginx

Compare dates on each backend IP with openssl s_client -connect IP:443 -servername example.com | openssl x509 -noout -enddate. If renewal itself fails, read Let's Encrypt renewal failures.

3. Old cross-signed chains

Historical example: in 2021, a widely used cross-sign root expired, and servers that still sent the old cross-signed chain broke for clients that tried the expired path. Firefox handled it better than some clients, but servers still had to adjust. The lesson is to use the chain file your CA currently publishes and to avoid hard-coding an old bundle. Check your CA's documentation for current chains.

4. Why Firefox may behave differently from Chrome

Firefox maintains its own trust store (Mozilla's root program) instead of using the operating system's. It also preloads known intermediate certificates, which can hide a missing-intermediate problem in some cases and expose an expired one in others. Test with several clients. Do not rely on one browser accepting your configuration as proof that it is correct.

5. Certificates on non-web ports and services

The same code appears when Firefox opens an admin interface on an unusual port, a router page or an internal tool with a self-made certificate. Reissue it, and set up renewal reminders. Short lifetimes are now the norm for public certificates, so plan on automation. See how to renew SSL certificates.

Confirm the fix

1. Run the SSL Checker to view the leaf's validity period and issuer.
2. Use the SSL Chain Debugger to verify that all intermediates are current.
3. For many hostnames, run the Bulk SSL Checker and sort by days remaining.
4. Add certificate expiry alerts to an uptime monitor, and watch the registration date with the domain expiry watch.
5. Reload in Firefox with a private window. Firefox may cache an override you previously added, so remove stale exceptions under Settings, Privacy and Security, Certificates.

Next steps

• Read the full SSL/TLS certificate errors guide.
• Compare with ERR_CERT_DATE_INVALID for the Chromium wording.
• Triage the generic warning in Your connection is not private.
• Learn about certificate types.

FAQ

Why does Firefox say the certificate expired when I renewed it?

The server is probably still serving the old certificate or an expired intermediate, or your clock is wrong. Check the dates in Advanced and run the chain test.

Is the Accept the Risk button safe?

Only on sites where you control the server or understand why the error occurs. Do not use it for banking, shopping or accounts.

Why does the error appear on every site?

Check your system clock, and look for security software that substitutes its own certificate. Both affect all HTTPS sites at once.

Do I need to restart Firefox after fixing the clock?

Yes, restarting avoids reusing a failed certificate result held in memory.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.