NET::ERR_CERT_DATE_INVALID and certificate is not expired

When I try to access my website using https I receive the below error. This error only occurs from my computer regardless which browser I am using to access the home page. When I try to access the same website using another computer everything is fine and I don't receive this error. I am puzzled since the error seems to indicate invalid date, but the date has not expired. What should I do in order to resolve this issue?

NET::ERR_CERT_DATE_INVALID Subject: www.dimsum.dk

Issuer: R3

Expires on: 29. dec. 2021

Current date: 30. sep. 2021

PEM encoded chain:

Certificate Transparency:

SCT DigiCert Yeti2021 Log (Embedded in certificate, Verified)

SCT Google 'Xenon2021' log (Embedded in certificate, Verified)

Solution 1:

I just encountered a similar problem to this yesterday - my web server was only serving the site certificate, not the full certificate chain.

Some computers were finding the R3 certificate and were happy, but several macOS computers were not finding the new R3 certificate, instead using an older one, which expired on 29 September (two days ago), and whose Root CA (DST Root CA X3) expired on the following day.

The new R3 certificate expires in 2025, and is signed by a different CA: ISRG Root X1.

You can check the certificates your web server is sending with:

openssl s_client -connect www.dimsum.dk:443 -servername dimsum.dk -showcerts

You should see the R3 certificate (s:/C=US/O=Let's Encrypt/CN=R3) in the output, e.g.

Certificate chain
 0 s:/CN=www.dimsum.dk
   i:/C=US/O=Let's Encrypt/CN=R3
-----BEGIN CERTIFICATE-----
MIIFIDCCBAigAwIBAgISBFTpIRdz8BnEJ1HmwjjelP48MA0GCSqGSIb3DQEBCwUA
...
GWjksODOm3vblUBhcgfrBuBMpFE=
-----END CERTIFICATE-----
 1 s:/C=US/O=Let's Encrypt/CN=R3
   i:/C=US/O=Internet Security Research Group/CN=ISRG Root X1
-----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
...
nLRbwHOoq7hHwg==
-----END CERTIFICATE-----
 2 s:/C=US/O=Internet Security Research Group/CN=ISRG Root X1
   i:/O=Digital Signature Trust Co./CN=DST Root CA X3
-----BEGIN CERTIFICATE-----
MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/
...
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
-----END CERTIFICATE-----

No expiry dates are listed here, but note the R3 certificate is issued by the ISRG Root X1 certificate, and the Base64 top and tail of the certificates should match what is here - for the next few years at least.

Solution 2:

When I try to access my website using https I receive the below error. This error only occurs from my computer regardless which browser I am using to access the home page.

I am going to make the educated guess that your system time is actually accurate, but due to the time zone you are in, your system time the browser is reporting the certificate as invalid. The reason your certificate is invalid, is due to the fact the Root Certificate Authority (CA) Certificate (DST Root CA X3) that signed your certificate, is due to expire today.

The solution is to manually install the ISRG Root X1 certificate into the certificate store on your device. As of today, September 30th, 2021, ISRG Root X1 replaces DST Root CA X3. You shouldn't have to do anything. Running the current Chrome version on a supported operating system should already trust the ISRG Root X1 certificate. If the certificate continues not to be trusted. I would simply install the certificate manually to the certificate store.

enter image description here

You can manually import the certificate using the following command within a command prompt:

ertutil -ent -addstore Root isrgrootx1.der

Source: DST Root CA X3 expiration on Windows7. Which update I need to install? Are there workarounds?

To be clear, my suggestion is to manually install this, using the provided command.

Let's Encrypt has the following advice:

If you experience problems related to certificate chaining you should first review your configuration and make sure your server/website/device is sending the correct chain with the updated R3 intermediate signed by ISRG Root X1. It is unlikely that you need to force renewal to resolve issues related to R3 signed by DST Root CA X3 expiring. This thread and many more on the community offer advice to review and resolve this problem.

Earlier today, the DST Root CA X3 expired as planned. Most problems related to DST Root CA X3 expiring will not be solved by force renewal. Please search the forum and this this thread for help to resolve the problems you are experiencing before opening a new thread.

You might have luck removing the invalid chain contained within fullchain.pem (or the appropriately named file) on your system. You will want to remove the last entry in the file which should be the chain for DST Root CA X3. if clients still don't trust your website, after manually installing the correct certificate, it's the configuration of the web server that is to blame.

You might be able to resolve the problem by forcing a renewal of your certificate and specifically indicating a the preferred chain with the following abbreviated command.

certbot renew --force-renewal --preferred-chain "ISRG Root X1"

Source: Directory access problem

NET::ERR_CERT_DATE_INVALID and certificate is not expired

Solution 1:

Solution 2:

Related

Recent Posts