{"record":{"id":"07724f32f566d183","repo":"tailscale/tailscale","slug":"one-of-the-certs-expires-in-v-v","errorCode":null,"errorMessage":"one of the certs expires in %v: %v","messagePattern":"one of the certs expires in (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"prober/tls.go","lineNumber":103,"sourceCode":"\t\t\tif leafAuthorityKeyID == string(cert.SubjectKeyId) {\n\t\t\t\tissuerCert = cert\n\t\t\t}\n\t\t}\n\n\t\t// Do not check certificate validity period for self-signed certs.\n\t\t// The practical reason is to avoid raising alerts for expiring\n\t\t// DERP metaCert certificates that are returned as part of regular\n\t\t// TLS handshake.\n\t\tif string(cert.SubjectKeyId) == string(cert.AuthorityKeyId) {\n\t\t\tcontinue\n\t\t}\n\n\t\tif time.Now().Before(cert.NotBefore) {\n\t\t\terrs = append(errs, fmt.Errorf(\"one of the certs has NotBefore in the future (%v): %v\", cert.NotBefore, cert.Subject))\n\t\t}\n\t\tif latestAllowedExpiration.After(cert.NotAfter) {\n\t\t\tleft := cert.NotAfter.Sub(time.Now())\n\t\t\terrs = append(errs, fmt.Errorf(\"one of the certs expires in %v: %v\", left, cert.Subject))\n\t\t}\n\t}\n\n\tif len(leafCert.CRLDistributionPoints) == 0 {\n\t\tif !slices.Contains(leafCert.Issuer.Organization, \"Let's Encrypt\") {\n\t\t\t// LE certs contain a CRL, but certs from other CAs might not.\n\t\t\treturn\n\t\t}\n\t\tif leafCert.NotBefore.Before(time.Unix(letsEncryptStartedStaplingCRL, 0)) {\n\t\t\t// Certificate might not have a CRL.\n\t\t\treturn\n\t\t}\n\t\terrs = append(errs, fmt.Errorf(\"no CRL server presented in leaf cert for %v\", leafCert.Subject))\n\t\treturn\n\t}\n\n\terr := checkCertCRL(ctx, leafCert.CRLDistributionPoints[0], leafCert, issuerCert)\n\tif err != nil {","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/prober/tls.go#L85-L121","documentation":"Added by validateConnState when a non-self-signed certificate in the chain expires sooner than the configured latestAllowedExpiration threshold; the remaining time and subject are reported for alerting.","triggerScenarios":"Thrown at prober/tls.go:103 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["A certificate expires soon; renew the certificate for the probed service."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}