A browser warning about a certificate date means the certificate presented for that connection is outside its validity period, or the device clock makes it appear so. This guide shows how to inspect the certificate your browser received and how to read the validity dates from a server using OpenSSL. These are point-in-time checks: this static page does not connect to or scan arbitrary websites.

Check the certificate in your browser

1. Open the exact HTTPS hostname that is failing, including the relevant subdomain. A certificate for www.example.com may differ from one for example.com.
2. Open the browser's connection or site information control next to the address bar, then open the certificate or connection details. The labels and steps vary by browser and version.
3. Find the certificate's validity period, commonly shown as “valid from” and “valid until” or “not before” and “not after.” Check that the current date and time fall within that period.
4. Check the subject or subject alternative names for the hostname you opened, and note the issuer. A date check alone does not establish that the certificate matches the hostname or chains to a trusted issuer.

If only one device reports a date error, check that device's clock, date, time zone, and automatic time setting before changing the website certificate. Also try another current browser or device to see whether the same certificate is presented.

Inspect a server certificate with OpenSSL

On a machine with OpenSSL installed, replace both instances of www.example.com with the hostname you want to inspect. This requests port 443, sends that hostname using SNI, and prints the first certificate returned by the server, usually its leaf certificate:

openssl s_client -connect www.example.com:443 -servername www.example.com -showcerts </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Look for notBefore and notAfter. OpenSSL displays these certificate times in GMT/UTC. The output shows the dates from the certificate served to this connection; it is not a complete diagnosis of trust, hostname matching, every certificate in a chain, or what a different edge server may present. For IPv6 literals or a nonstandard port, consult the OpenSSL command documentation for the appropriate connection syntax.

If the command prints no certificate, the TLS handshake may have failed, the host may not serve HTTPS on that port, or your shell/OpenSSL environment may differ. Rerun without redirecting standard error to inspect the connection details. Do not treat a failed command as proof that a certificate is expired.

If the date is wrong or the certificate is near expiry

1. Compare the certificate's end date with the current UTC time and check the computer clock. A certificate can be expired, not yet valid, or appear invalid because the local clock is wrong.
2. Check each hostname visitors use, including the apex and www name, plus any relevant subdomains. Different hostnames or delivery endpoints can serve different certificates.
3. If you manage the site, identify who provisions TLS: your host, reverse proxy, CDN, load balancer, or certificate automation. Renew or reissue the certificate through that system, then confirm the updated certificate is deployed on every relevant endpoint.
4. Retest from the browser and with OpenSSL. Confirm the validity window and hostname, and investigate any separate trust-chain or handshake warning with the service that terminates TLS.

Do not tell visitors to bypass a certificate warning. It can indicate a real identity or connection problem, and browser behavior differs. If a provider manages HTTPS, send support the exact hostname, the warning text, the time observed with time zone, and the certificate dates; do not send private keys.

For adjacent hosting operations, see the hosting move checklist and DNS record format checker. DNS checks can help confirm where a hostname points, but DNS records do not establish certificate validity.

Sources checked November 3, 2026

• MDN: Transport Layer Security — explains HTTPS server authentication and the role of website certificates.
• OpenSSL 3.0 s_client documentation — documents TLS client connection options, including SNI and certificate display.
• OpenSSL 3.3 x509 documentation — documents certificate display options, including subject, issuer, dates, and -noout.