{"record":{"id":"536ccabc47c36ad1","repo":"gravitational/teleport","slug":"notbefore-notafter","errorCode":null,"errorMessage":"NotBefore > NotAfter","messagePattern":"NotBefore > NotAfter","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/subca/parsed.go","lineNumber":357,"sourceCode":"\t\t\tcertClusterName,\n\t\t\tclusterName,\n\t\t)\n\t}\n\n\t// Verify certificate constraints.\n\tswitch {\n\tcase !cert.IsCA:\n\t\treturn errors.New(\"not a CA certificate (IsCA=false)\")\n\tcase !cert.BasicConstraintsValid:\n\t\treturn errors.New(\"basic constraints not valid (BasicConstraintsValid=false)\")\n\tcase cert.KeyUsage&x509.KeyUsageCertSign == 0:\n\t\t// Usage names per Go 1.26.1.\n\t\t// https://cs.opensource.google/go/go/+/refs/tags/go1.26.1:src/crypto/x509/x509_string.go;l=23\n\t\treturn errors.New(\"missing KeyUsage keyCertSign\")\n\tcase cert.KeyUsage&x509.KeyUsageCRLSign == 0:\n\t\treturn errors.New(\"missing KeyUsage cRLSign\")\n\tcase cert.NotBefore.After(cert.NotAfter):\n\t\treturn errors.New(\"NotBefore > NotAfter\")\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":339,"sourceCodeEnd":362,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/subca/parsed.go#L339-L362","documentation":"validateOverrideCertificate checks the certificate's own validity interval: NotBefore must not be after NotAfter. Such a certificate has an impossible validity window and can never be valid, so the library rejects it outright.","triggerScenarios":"Supplying an override certificate whose encoded NotBefore timestamp is later than its NotAfter timestamp, encountered when parsing it in ValidateAndParseCAOverride.","commonSituations":"Corrupted or hand-edited certificate files; misconfigured issuance tooling that computes the expiry from a wrong clock or negative duration; truncated/mangled PEM material.","solutions":["Re-issue the certificate with a valid window (NotBefore <= now, NotAfter > NotBefore).","Check the certificate dates with 'openssl x509 -in cert.pem -noout -dates' and compare them.","Audit the issuing tooling/system clock if the certificate was generated with a negative validity duration."],"exampleFix":"// before (Go template)\nNotBefore: time.Now(),\nNotAfter:  time.Now().Add(-24 * time.Hour), // negative validity\n// after\nNotBefore: time.Now(),\nNotAfter:  time.Now().Add(365 * 24 * time.Hour),","handlingStrategy":"validation","validationCode":"if cert.NotBefore.After(cert.NotAfter) {\n    return errors.New(\"override cert has invalid validity window (NotBefore > NotAfter)\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run 'openssl x509 -noout -dates' and sanity-check the window before use.","Guard issuance code against negative validity durations.","Monitor NTP/clock health on hosts that mint certificates."],"tags":["x509","certificate","validity","validation"],"backgroundTag":"certificate-expired-or-invalid-dates","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}