{"record":{"id":"18c0a0dfecf33c35","repo":"dgraph-io/dgraph","slug":"duration-certificate-expiration-date-s-excee","errorCode":null,"errorMessage":"--duration: certificate expiration date '%s' exceeds parent '%s'","messagePattern":"--duration: certificate expiration date '(.+?)' exceeds parent '(.+?)'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dgraph/cmd/cert/cert.go","lineNumber":103,"sourceCode":"\t\t\t} else {\n\t\t\t\ttemplate.DNSNames = append(template.DNSNames, h)\n\t\t\t}\n\t\t}\n\n\tcase c.client != \"\":\n\t\ttemplate.Subject.CommonName = c.client\n\t\ttemplate.KeyUsage = x509.KeyUsageDigitalSignature\n\t\ttemplate.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}\n\t}\n\n\tif c.signer == nil {\n\t\tc.signer = key\n\t}\n\n\tif c.parent == nil {\n\t\tc.parent = template\n\t} else if template.NotAfter.After(c.parent.NotAfter) {\n\t\treturn errors.Errorf(\"--duration: certificate expiration date '%s' exceeds parent '%s'\",\n\t\t\ttemplate.NotAfter, c.parent.NotAfter)\n\t}\n\n\tder, err := x509.CreateCertificate(rand.Reader,\n\t\ttemplate, c.parent, key.Public(), c.signer)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tfp, err := safeCreate(certFile, c.force, 0666)\n\tif err != nil {\n\t\t// check the existing cert.\n\t\tif os.IsExist(err) {\n\t\t\t_, err = readCert(certFile)\n\t\t}\n\t\treturn err\n\t}\n\tdefer func() {","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/dgraph/cmd/cert/cert.go#L85-L121","documentation":"In generatePair (dgraph/cmd/cert/cert.go:103), the Dgraph cert tool refuses to create a certificate whose NotAfter would outlive its signing parent CA. When a --duration/until value produces a template expiration later than the parent's NotAfter, the resulting chain would be invalid, so the tool fails fast before calling x509.CreateCertificate. It applies whenever a node or client cert is generated under an existing CA.","triggerScenarios":"Running `dgraph cert` (createNodePair/createClientPair) with a --duration (until) flag large enough that time.Now()+duration exceeds the NotAfter of the existing root CA, e.g. creating a new node/client cert with --duration 87600 after the CA was created with a shorter duration.","commonSituations":"Operator created a CA with a 1-year duration, later regenerates leaf certs with the default or a longer duration; script reruns `dgraph cert --nodes --client` months after the CA was issued with a shorter lifetime; user assumes leaf cert duration is independent of the CA.","solutions":["Pass a smaller --duration to dgraph cert so the new cert expires before the parent CA.","Regenerate the root CA (dgraph cert --ca --force) with the longer lifetime, then re-issue node and client certs.","Check the parent CA's expiry (`dgraph cert --info` or openssl x509 -enddate) before choosing --duration."],"exampleFix":"// before\ndgraph cert --ca_certs ca.crt --client --duration 87600  // 10y leaf under 1y CA\n// after\ndgraph cert --ca_certs ca.crt --client --duration 8760   // fits within CA lifetime","handlingStrategy":"validation","validationCode":"// Check parent CA expiry before requesting a leaf cert with a given duration\ncaCert, err := readCert(\"ca.crt\")\nif err != nil { return err }\nrequested := time.Now().AddDate(0, 0, until)\nif requested.After(caCert.NotAfter) {\n    return fmt.Errorf(\"--duration %dd exceeds CA expiry %s\", until, caCert.NotAfter)\n}","typeGuard":null,"tryCatchPattern":"if err := createClientPair(...); err != nil {\n    if strings.Contains(err.Error(), \"exceeds parent\") {\n        // reduce --duration or renew the CA, then retry\n    }\n    return err\n}","preventionTips":["Always create the CA with a lifetime longer than any leaf cert you plan to issue.","Before renewing leaf certs, run `dgraph cert --info` to read the CA NotAfter.","Standardize durations (e.g. CA 10y, leaves 1y) in your provisioning scripts.","Set alerts for CA expiry, not just leaf expiry."],"tags":["x509","certificate","duration","pki"],"backgroundTag":"certificate-outlives-parent-ca","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}