Direct answer

The certificate presented by the server is outside its validity window, or the verifying machine has an incorrect clock. Check the live certificate before replacing files blindly.

Where this error appears

HTTPS clients, reverse proxies, CDNs, APIs, and direct TLS services

Root cause

The leaf certificate may have expired, a renewed certificate may not be loaded, regional endpoints may serve different chains, or the client/server clock may be wrong.

Minimal reproduction

TLS
x509: certificate has expired or is not yet valid

Corrected example

FIXED
Confirm UTC time, renew or deploy the correct certificate and full intermediate chain, reload the terminating service, then recheck the exact public hostname.

Verify the fix

TERMINAL
Use the TLS Certificate Checker against the public hostname and confirm Verified plus a positive Days remaining value.

Things to check

  • Check the certificate actually served, not only the file on disk.
  • Confirm every load balancer or CDN region has the new certificate.
  • Do not disable TLS verification as a fix.