Fix

Certificate not yet valid or expired on one machine

When one machine sees a good certificate as not yet valid or expired, its clock is wrong. Fix the time with NTP, not the certificate.

Likely causes

The machine's clock is off by months or years: no NTP, or NTP following a wrong server.
The certificate really has expired: then every machine fails, not just one.

Run these in order. The output is what each printed on a lab's real Linux machines.

laptop:~# curl -sS https://bank.lab/: With the right time the certificate is fine.
hello from bank
laptop:~# faketime -f -730d curl -sS https://bank.lab/: Two years slow: certificate is not yet valid.
curl: (60) SSL certificate problem: certificate is not yet valid …
laptop:~# faketime -f +730d curl -sS https://bank.lab/: Two years fast: certificate has expired.
curl: (60) SSL certificate problem: certificate has expired …
laptop:~# chronyc sources: Two time servers disagree by 17520h and neither is trusted (x): the clock has nobody to follow.
MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^x timeServer 2 0 377 0 +750ns[ +750ns] +/- 83us ^x brokenClock 2 0 7 0 +17520h[+17520h] +/- 104us

laptop:~# chronyc add server 10.0.2.10 iburst: Add another time server, so the good ones outvote the wrong one.
200 OK
laptop:~# chronyc sources: ^* marks the server the clock now follows; the wrong one stays x.
MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^+ timeServer 2 1 377 1 -7122ns[-7122ns] +/- 87us ^x brokenClock 2 0 377 0 +17520h[+17520h] +/- 83us ^* referenceClock 1 6 7 1 +5515ns[+7861ns] +/- 53us

Each lab is a small network of real Linux machines in your browser, where this fault happens.