{"record":{"id":"074bb3465e762a95","repo":"k3s-io/k3s","slug":"s-s-certificate-s-is-not-valid-before-s","errorCode":null,"errorMessage":"%s/%s: certificate %s is not valid before %s","messagePattern":"(.+?)/(.+?): certificate (.+?) is not valid before (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/certmonitor/certmonitor.go","lineNumber":131,"sourceCode":"}\n\nfunc checkCerts(fileMap map[string][]string, warningPeriod time.Duration) error {\n\terrs := []error{}\n\tnow := time.Now()\n\twarn := now.Add(warningPeriod)\n\n\tfor service, files := range fileMap {\n\t\tfor _, file := range files {\n\t\t\tbasename := filepath.Base(file)\n\t\t\tcerts, _ := certutil.CertsFromFile(file)\n\t\t\tfor _, cert := range certs {\n\t\t\t\tusages := util.GetCertUsages(cert)\n\t\t\t\tcertificateExpirationSeconds.WithLabelValues(cert.Subject.String(), strings.Join(usages, \",\")).Set(cert.NotAfter.Sub(now).Seconds())\n\t\t\t\tstatus := util.GetCertStatus(cert, now, warn)\n\t\t\t\tif status != util.CertStatusOK {\n\t\t\t\t\tswitch status {\n\t\t\t\t\tcase util.CertStatusNotYetValid:\n\t\t\t\t\t\terrs = append(errs, fmt.Errorf(\"%s/%s: certificate %s is not valid before %s\", service, basename, cert.Subject, cert.NotBefore.Format(time.RFC3339)))\n\t\t\t\t\tcase util.CertStatusExpired:\n\t\t\t\t\t\terrs = append(errs, fmt.Errorf(\"%s/%s: certificate %s expired at %s\", service, basename, cert.Subject, cert.NotAfter.Format(time.RFC3339)))\n\t\t\t\t\tcase util.CertStatusWarning:\n\t\t\t\t\t\terrs = append(errs, fmt.Errorf(\"%s/%s: certificate %s will expire within %d days at %s\", service, basename, cert.Subject, int(warningPeriod.Hours()/24), cert.NotAfter.Format(time.RFC3339)))\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\treturn errors.Join(errs...)\n}\n","sourceCodeStart":113,"sourceCodeEnd":144,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/certmonitor/certmonitor.go#L113-L144","documentation":"Error \"%s/%s: certificate %s is not valid before %s\" thrown in k3s-io/k3s.","triggerScenarios":"Thrown at pkg/certmonitor/certmonitor.go:131 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}