SEC_ERROR_EXPIRED_CERTIFICATE in Firefox

Firefox SEC_ERROR_EXPIRED_CERTIFICATE means the server certificate’s notAfter is before now—renew and reload the listener users hit.

Firefox uses its own certificate viewer and error strings, but PKIX rules match other browsers. Expired certificates produce SEC_ERROR_EXPIRED_CERTIFICATE instead of Chromium’s NET::ERR_CERT_DATE_INVALID.

Privacy-focused users disproportionately report Firefox issues; treat those tickets as real production signals, not edge noise.

First response

Firefox SEC_ERROR_EXPIRED_CERTIFICATE means notAfter is before the current time. Confirm with openssl s_client, renew the leaf, and reload the web server or load balancer.

Search interest in SEC_ERROR_EXPIRED_CERTIFICATE rises when the leaf notAfter on the hostname customers type is already in the past. Clients cannot rewrite server certificate dates; they only accept chains that pass PKIX checks at handshake time.

For SEC_ERROR_EXPIRED_CERTIFICATE in Firefox, prove the failure from outside your office VPN before you change application code, purge caches, or ask end users to reboot. Capture the broken serial number and notAfter, renew on the listener that actually terminates that name, reload every node in the path, then re-run the same OpenSSL and browser checks that opened the incident.

Escalations for err-cert-date-invalid-firefox should cite fresh openssl notBefore/notAfter compared to Firefox about:networking output before anyone edits client code or blames Wi‑Fi. Firefox SEC_ERROR_EXPIRED_CERTIFICATE means notAfter is before the current time. Confirm with openssl s_client, renew the leaf, and reload the web server or load balancer. When SEC_ERROR_EXPIRED_CERTIFICATE clusters around Firefox NSS path validation, the expired material is usually bound to the leaf served when Firefox opens the site instead of a mysterious platform bug. Executive summaries need the public hostname and current notAfter, not screenshots from a VPN-split test laptop.

See also Android SSL certificate expired errors and Certificate chain incomplete in the browser.

What this error means

Gecko validates notBefore/notAfter in UTC. Supernova updates may change UI text, but expired material still hard-fails.

Enterprise roots distributed via policy do not bypass expired publicly trusted certificates on the internet.

Renew with Mozilla-friendly cipher suites and full chain, then confirm in a fresh Firefox profile.

In PKIX terms, Firefox NSS path validation treat the TLS Certificate message as authoritative: signatures must verify, each link must be within notBefore/notAfter, and only then does name matching run against CN and SAN. When the leaf expired, SEC_ERROR_EXPIRED_CERTIFICATE is expected even if the issuer is publicly trusted. Guides titled err cert date invalid firefox still require reading dates on every certificate the server sends, including forgotten cross-sign intermediates.

Triage for err cert date invalid firefox should reject quick myths: flushing DNS or rebooting laptops does not move server notAfter forward. It is not proof the whole internet is broken when other HTTPS sites load for Firefox NSS path validation. It is not interchangeable with registrar billing lapses unless revalidation fails later. It is not fixed by turning off TLS at the load balancer while marketing keeps publishing https:// links. Validated externally, openssl notBefore/notAfter compared to Firefox about:networking must show fresh dates on the leaf served when Firefox opens the site before you close the incident.

Common causes

These patterns appear often during SEC_ERROR_EXPIRED_CERTIFICATE incidents. They are not exhaustive, but they explain why renewal looked finished internally while strangers still received expired material.

Runbooks for err cert date invalid firefox most often break at handoff: certbot or a vendor portal issued new certs, but the leaf served when Firefox opens the site never received a reload. Teams tracked PEM files in git while production continued serving the previous listener binding. OV renewals waited on legal approvers until SEC_ERROR_EXPIRED_CERTIFICATE became customer-visible. Inventory spreadsheets omitted the hostname that Firefox NSS path validation actually call during peak traffic.

Architecture amplifies err cert date invalid firefox: multiple regions, canary pools, or blue/green deploys can leave one ASG member presenting yesterday's fullchain. Shared IP default certificates silently terminate vanity hostnames without dedicated SNI rules. Mounted TLS secrets updated on disk while Envoy or nginx workers kept the old chain until signaled. Firefox SEC_ERROR_EXPIRED_CERTIFICATE means notAfter is before the current time becomes harder to debug when only a fraction of Firefox NSS path validation hit the stale anycast node.

Measurement gaps complete the story for err cert date invalid firefox. Synthetic monitors that disable certificate verification greenlit deploys that fail for real Firefox NSS path validation. Redirect maps hid which hop expired until operators ran openssl notBefore/notAfter compared to Firefox about:networking per hostname. Dashboards celebrated TCP uptime while notAfter crossed midnight UTC without a page. Post-mortems should ask whether CT logs or stapled OCSP would have warned days earlier.

Confirm from the outside

OpenSSL

echo | openssl s_client -connect HOST:443 -servername HOST 2>/dev/null | openssl x509 -noout -dates -subject -issuer

External dates should match what Firefox shows in certificate details.

How to read the output

Start with openssl notBefore/notAfter compared to Firefox about:networking against the live customer hostname, capturing the leaf presented after SNI selection. Interpret notBefore= and notAfter= first: past notAfter guarantees failure for SEC_ERROR_EXPIRED_CERTIFICATE regardless of pretty issuer branding. Next read subject= and any X509v3 Subject Alternative Name extension for alignment with the URL bar. Finally note issuer= so you know whether renewal changed intermediates; record serial numbers in the ticket for post-deploy diffing.

curl

curl -vI --connect-timeout 10 https://HOST/ 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

Use curl on the same URL; expired certs fail before HTTP on all strict clients.

Browser spot-check

Open padlock → More information → View Certificate and read Validity.

Fix checklist

Work this list in order for sec_error_expired_certificate in firefox. Each step should produce evidence (command output, timestamps, serial numbers) you can paste into the incident ticket.

1. Reproduce in Firefox Release without extensions.
2. OpenSSL with matching SNI from external network.
3. Renew leaf and deploy fullchain.
4. Reload nginx/Apache/haproxy or cloud LB.
5. Retest Firefox desktop and Android if used.
6. Check OCSP stapling after reload (optional sanity).
7. Update monitoring with Firefox user-agent fetch if desired.
8. Close incident only after openssl shows future notAfter.

Roll out and verify

Procurement for err cert date invalid firefox begins with a reissue that lists every hostname Firefox NSS path validation need, including forgotten admin and callback URLs. Validate CSR/key pairs, download CA bundles, and schedule work on the leaf served when Firefox opens the site during a staffed change window. If automation handles ACME, prove challenges use the same DNS names customers resolve publicly, not internal-only labels.

Installation for err cert date invalid firefox means concatenating leaf and required intermediates the way your stack documents, then touching every node that terminates the name. Reload web servers, recycle ingress pods, or update cloud listener objects so data planes read new bytes. For load balancers, sync default and per-host certificates so SNI cannot fall back to expired defaults. Repeat openssl notBefore/notAfter compared to Firefox about:networking until fingerprints or serials change everywhere responders tested earlier.

Verification for err cert date invalid firefox must mimic strangers: external synthetics, mobile carriers, and CI jobs without corporate trust roots. Confirm SEC_ERROR_EXPIRED_CERTIFICATE disappeared for Firefox NSS path validation on flows heavier than GET /. Restore any strict TLS, HSTS, or CDN SSL modes relaxed during firefighting. Feed the hostname into continuous notAfter monitoring with thresholds well before the next CA-enforced renewal cliff.

What to automate

Certificate files on disk lie. Automate live TLS checks on the exact hostname and port users hit, including redirects and the certificate presented after TLS terminates on a load balancer or CDN. Pair certificate notAfter with RDAP domain registration expiry so re-validation is not blocked by a lapsed registrar.

Keep Firefox-specific synthetic checks for high-traffic sites. Schedule alerts at 30, 14, 7, and 1 day before expiry so on-call has runway for ACME failures, manual OV revalidation, or change windows. Services such as ssldays can run external checks and renewal reminders without replacing your CA workflow.