How to bypass "net::ERR_CERT_DATE_INVALID" in Puppeteer and Playwright

When you want to bypass, not fix

net::ERR_CERT_DATE_INVALID occurs when a TLS certificate has expired or its validity period hasn't started yet. If you're testing against internal tools, staging environments, or self-signed certificates and have decided not to update the certificate itself, you can configure your browser automation tool to ignore the certificate error and proceed with the request.

Puppeteer: using ignoreHTTPSErrors

The simplest way in Puppeteer is to set ignoreHTTPSErrors in the browser context or launch options:

import puppeteer from 'puppeteer';

const browser = await puppeteer.launch();
const page = await browser.newPage();

// Set ignoreHTTPSErrors at the page level
await page.goto('https://expired-cert-site.example.com', {
  waitUntil: 'networkidle2',
});

const content = await page.content();
console.log(content);

await browser.close();

Alternatively, set it at browser launch time to apply across all pages:

const browser = await puppeteer.launch({
  ignoreHTTPSErrors: true,
});

const page = await browser.newPage();
await page.goto('https://expired-cert-site.example.com');

Puppeteer: using Chrome CLI flags

For more control, launch Chrome with the --ignore-certificate-errors flag:

const browser = await puppeteer.launch({
  args: ['--ignore-certificate-errors'],
});

const page = await browser.newPage();
await page.goto('https://expired-cert-site.example.com');

Fine-grained control with --ignore-certificate-errors-spki-list

If you want to bypass certificate errors only for a specific certificate (identified by its SPKI hash), use --ignore-certificate-errors-spki-list:

const browser = await puppeteer.launch({
  args: ['--ignore-certificate-errors-spki-list=SPKI_HASH_HERE'],
});

Why use this over the blanket flag? The SPKI list restricts the bypass to a specific certificate's public key hash, reducing the attack surface. Instead of trusting all bad certificates (which could enable MITM attacks), you're only trusting certificates you've explicitly pinned by their public key hash.

To extract a certificate's SPKI hash:

openssl s_client -connect expired-cert-site.example.com:443 < /dev/null | \
  openssl x509 -noout -pubkey | \
  openssl pkey -pubin -outform DER | \
  openssl dgst -sha256 -binary | \
  base64

Then pass the hash to the flag.

Playwright: using ignoreHTTPSErrors

Playwright offers similar functionality at the browser context level:

import { chromium } from 'playwright';

const browser = await chromium.launch();
const context = await browser.newContext({
  ignoreHTTPSErrors: true,
});

const page = await context.newPage();
await page.goto('https://expired-cert-site.example.com');

const content = await page.content();
console.log(content);

await browser.close();

Or at launch time:

const browser = await chromium.launch({
  ignoreHTTPSErrors: true,
});

Playwright: using Chrome CLI flags

You can also pass the same Chrome flags through Playwright:

const browser = await chromium.launch({
  args: ['--ignore-certificate-errors'],
});

When bypassing is acceptable

Internal staging/testing: Self-signed or expired certificates in non-production environments.
Controlled crawling of known targets: When you trust the server despite its certificate being invalid.
Legacy systems: Older internal tools with outdated certificate infrastructure.

When NOT to bypass

Public or third-party sites: Bypassing certificate errors on unknown sites opens you to Man-in-the-Middle (MITM) attacks. An attacker could intercept your connection and steal data.
Production scrapers: If you're running production scraping or data collection, certificate validation exists for security. Disabling it is a significant risk.
User-facing applications: Never disable certificate checking in code that runs on behalf of end users.

Alternative: Fix the certificate

Rather than bypassing, consider:

Update the certificate on the target server
Import a CA certificate into the system's trust store
Use a self-signed certificate with Playwright's ca option (if you control the server)

See How to fix net::ERR_CERT_DATE_INVALID in Puppeteer for more on permanent solutions.