Practical security for everyday technology.

A Wrong Device Clock Can Make a Valid Website Certificate Look Expired

A person checking the date and time settings on a laptop at home.
AI-generated photographic illustration; not documentary photography.

Several familiar websites suddenly show certificate warnings after a device has been unused for months. Before changing browser security settings, look at the system clock. A certificate has a validity period, and a device that believes it is in the wrong year can judge that period incorrectly.

Mozilla’s time-related error guide explains how an incorrect date, time or time zone can trigger warnings. It also stresses that a correct clock does not rule out an expired or misconfigured certificate on the website itself.

Correct the device, then test again

Read the warning rather than dismissing it. Check the operating system’s date, time and time-zone settings against a trusted clock. Where appropriate, enable the system’s normal automatic time synchronisation and confirm that it has actually updated.

Close and reopen the affected page after the correction. If the error disappears across the sites that failed, the clock was a useful lead. If only one site still fails, keep investigating that site-specific warning instead of assuming the remaining problem has the same cause.

Keep a small record of what changed

For example, a laptop might display the correct hour but the wrong year. Recording that detail explains far more than “the internet was broken.” Note the error code, the previous clock setting and whether the correction persisted after a restart.

A clock that repeatedly resets may need help from the device manufacturer or a technician. Managed work devices can also have time settings controlled by an administrator. Avoid installing an unfamiliar certificate or disabling verification to work around a recurring error.

If the clock is correct and a warning remains, do not enter passwords or payment details through the warning. Check the site’s official support channel through a route you already trust. Some browser protections deliberately prevent bypassing particular certificate failures.

The clock check is useful because it tests one concrete explanation with a reversible setting. It is not a declaration that every familiar-looking page is genuine. Once the time is right, the browser still needs to verify the connection, and the identity of the service still matters.