NET::ERR_CERT_VALIDITY_TOO_LONG: Fix Guide
NET::ERR_CERT_VALIDITY_TOO_LONG appears when an SSL certificate is issued for > 398 days. Since September 2020, Apple, Google and Mozilla reject certs longer than that — per Baseline Requirements 1.7.3. Fix: reissue with validity ≤ 397 days (Let's Encrypt = 90 days, always fits).
This error blocks HTTPS access. Below: causes, fixes, working config, FAQ.
Common Causes
- Cert issued for 2+ years (legacy practice before September 2020)
- Commercial CA delivered an "extended validity" cert bypassing the limit
- Self-signed cert with
days=10000— a common admin mistake - Legacy certificate reissued with old parameters
- Firewall/proxy replaced the cert with a long-validity one
Step-by-Step Fix
- Reissue the certificate:
certbot renew --force-renewal - For self-signed:
openssl req -x509 -days 365(not 3650!) - Ask your commercial CA for a 1-year cert — 2-year ones were pulled in 2020
- Check the actual validity via Enterno SSL Checker — Not Before → Not After
- Corporate proxy: exclude your domain from SSL inspection
Example: Proper nginx TLS config
server {
listen 443 ssl http2;
server_name example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers off;
ssl_stapling on;
ssl_stapling_verify on;
}Related SSL Errors
Why teams trust us
How it works
Enter domain
TLS chain verified
Expiry date & vulnerabilities
What Does the SSL Check Cover?
SSL/TLS is the encryption protocol that protects data between the browser and server. Our tool analyzes the certificate, chain of trust, TLS version, and knownvulnerabilities.
Certificate Details
Issuer, validity period, signature algorithm, covered domains (SAN), and validation type (DV/OV/EV).
Chain of Trust
Full chain verification: from leaf certificate through intermediates to root CA.
TLS Analysis
Protocol version (TLS 1.2/1.3), cipher suites, Perfect Forward Secrecy (PFS) support.
Expiry Alerts
Set up a monitor — get Telegram and email alerts 30/14/7 days before expiration.
DV vs OV vs EV Certificates
- Confirms domain ownership only
- Issued in minutes automatically
- Free via Let's Encrypt
- Suitable for most websites
- Most common certificate type
- Organization (OV) or Extended Validation (EV)
- Issued in 1-5 business days
- Costs $50 to $500/year
- For finance, e-commerce, government sites
- Increases user trust
Who uses this
DevOps
SSL certificate monitoring
Security
TLS config audit
SEO
HTTPS as ranking factor
E-commerce
customer trust
Common Mistakes
www and subdomains.Best Practices
Strict-Transport-Security header forces browsers to always use HTTPS.Get more with a free account
SSL certificate monitoring, check history and alerts 30 days before expiry.
Sign up freeLearn more
How-to
Frequently Asked Questions
Why did Apple/Google/Mozilla cap the validity?
Shorter certs force more frequent reissuance → lower key-compromise risk and faster retirement of vulnerable certs.
Why exactly 398 days?
That is 13 months + renewal buffer. Apple introduced the cap in 2020: max 398 days. Google and Mozilla followed.
Can I bypass it with Chrome flags?
No. This is a built-in safetynet policy, not toggleable.
Let's Encrypt's 90 days is annoying, alternatives?
ZeroSSL, Buypass — free alternatives with 90-day certs. Commercial (DigiCert, Sectigo) — 1 year. All ≤ 398 days.