---
title: "NET::ERR_CERT_DATE_INVALID on Mac: check the clock first · Kilobat Guides"
url: "https://kilobat.app/guides/err-cert-date-invalid.html"
description: "Chrome on your Mac shows NET::ERR_CERT_DATE_INVALID. Check the Mac's date and time first, then the site's certificate and the network."
---

Error messages

# NET::ERR_CERT_DATE_INVALID in Chrome on Mac

The server's certificate looks expired or not yet valid by the Mac's clock. Chromium names three causes: a wrong clock, a bad server certificate, or an attacker.

Applies to: Google Chrome and other Chromium browsers on all current macOS versions. The Date & Time path is for macOS 13 and later. · Checked: 29 October 2026

## Symptoms

- Chrome shows “Your connection is not private” with NET::ERR_CERT_DATE_INVALID.
- Chrome shows “Your clock is behind” or “Your clock is ahead”.
- Many secure sites fail at the same time.

## Likely causes

- **A wrong date or time on the Mac.** If many sites fail at once, the clock is the most likely cause.
- **An expired certificate on the server.** If only one site fails, its owner did not renew the certificate.
- **A network that shows its own certificate.** A login page or an inspecting proxy can answer with an old certificate.
- **An attack.** Chromium says that an attacker can present an old certificate. Do not continue to the site.

## How to check

1. Choose Apple menu > System Settings > General > Date & Time. Compare the date and time with your phone.
2. Show the date and time from Terminal.

   ```
   date
   ```
3. Open other secure sites. Note if many fail.
4. Show the dates of the site's certificate.

   ```
   curl -vI https://example.com 2>&1 | grep -E 'start date|expire date'
   ```

## How to fix it

1. Turn on “Set time and date automatically” in Date & Time. Make sure the time zone is correct.
2. Restart Chrome after you fix the clock.
3. If only one site has an expired certificate, wait for its owner to fix it. Do not enter passwords there.
4. On public Wi-Fi, sign in to the network first. See [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html).

## With Kilobat

1. Kilobat's connection doctor tests the site layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why https://example.com
   ```
2. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

## Questions

**Can I click through the warning?**

Not on a site where you enter a password or payment. An expired certificate does not prove that the site is safe.

## Sources

- [Chromium source: net/base/net_error_list.h](https://source.chromium.org/chromium/chromium/src/+/main:net/base/net_error_list.h)
- [Chromium source: components/security_interstitials_strings.grdp](https://source.chromium.org/chromium/chromium/src/+/main:components/security_interstitials_strings.grdp)
- [Apple Support: Set the date and time automatically on your Mac](https://support.apple.com/guide/mac-help/set-the-date-and-time-automatically-mchlp2996/mac)
- curl(1) and date(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

## Related guides

- [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac.html): Safari shows a certificate warning when it cannot confirm the identity of a website.
- [What is timed on Mac?](https://kilobat.app/guides/what-is-timed.html): timed keeps the Mac's clock correct.
- [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html): Public networks often hold all traffic until you sign in on a login page.
- [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html): Some company networks inspect HTTPS traffic.