{"record":{"id":"a0c8d9f34255ea4c","repo":"oven-sh/bun","slug":"error-in-cert-not-before-field","errorCode":"ERROR_IN_CERT_NOT_BEFORE_FIELD","errorMessage":"ERROR_IN_CERT_NOT_BEFORE_FIELD","messagePattern":"ERROR_IN_CERT_NOT_BEFORE_FIELD","errorType":"error_code","errorClass":"CertError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":147,"sourceCode":"    #[error(\"UNABLE_TO_DECRYPT_CERT_SIGNATURE\")]\n    UNABLE_TO_DECRYPT_CERT_SIGNATURE,\n    #[error(\"UNABLE_TO_DECRYPT_CRL_SIGNATURE\")]\n    UNABLE_TO_DECRYPT_CRL_SIGNATURE,\n    #[error(\"UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY\")]\n    UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY,\n    #[error(\"CERT_SIGNATURE_FAILURE\")]\n    CERT_SIGNATURE_FAILURE,\n    #[error(\"CRL_SIGNATURE_FAILURE\")]\n    CRL_SIGNATURE_FAILURE,\n    #[error(\"CERT_NOT_YET_VALID\")]\n    CERT_NOT_YET_VALID,\n    #[error(\"CERT_HAS_EXPIRED\")]\n    CERT_HAS_EXPIRED,\n    #[error(\"CRL_NOT_YET_VALID\")]\n    CRL_NOT_YET_VALID,\n    #[error(\"CRL_HAS_EXPIRED\")]\n    CRL_HAS_EXPIRED,\n    #[error(\"ERROR_IN_CERT_NOT_BEFORE_FIELD\")]\n    ERROR_IN_CERT_NOT_BEFORE_FIELD,\n    #[error(\"ERROR_IN_CERT_NOT_AFTER_FIELD\")]\n    ERROR_IN_CERT_NOT_AFTER_FIELD,\n    #[error(\"ERROR_IN_CRL_LAST_UPDATE_FIELD\")]\n    ERROR_IN_CRL_LAST_UPDATE_FIELD,\n    #[error(\"ERROR_IN_CRL_NEXT_UPDATE_FIELD\")]\n    ERROR_IN_CRL_NEXT_UPDATE_FIELD,\n    #[error(\"OUT_OF_MEM\")]\n    OUT_OF_MEM,\n    #[error(\"DEPTH_ZERO_SELF_SIGNED_CERT\")]\n    DEPTH_ZERO_SELF_SIGNED_CERT,\n    #[error(\"SELF_SIGNED_CERT_IN_CHAIN\")]\n    SELF_SIGNED_CERT_IN_CHAIN,\n    #[error(\"UNABLE_TO_GET_ISSUER_CERT_LOCALLY\")]\n    UNABLE_TO_GET_ISSUER_CERT_LOCALLY,\n    #[error(\"UNABLE_TO_VERIFY_LEAF_SIGNATURE\")]\n    UNABLE_TO_VERIFY_LEAF_SIGNATURE,\n    #[error(\"CERT_CHAIN_TOO_LONG\")]","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L129-L165","documentation":"X509 verify result 13 (X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD): the notBefore field of the certificate is malformed — an unparseable/invalid UTCTime or GeneralizedTime value, so validity cannot even be evaluated. Mapped via get_cert_error_from_no (src/http/lib.rs:1532) to CertError::ERROR_IN_CERT_NOT_BEFORE_FIELD (FetchTasklet.rs:1409).","triggerScenarios":"TLS handshake where the peer (or a CA in the chain) presents a certificate whose notBefore encodes an invalid date, typically from a broken homegrown cert generator.","commonSituations":"Self-signed certs made with hand-rolled scripts/openssl -startdate with bad formats, certs generated by buggy embedded tools or IoT firmware, or DER corruption of the validity section.","solutions":["Regenerate the certificate with a standard tool (openssl req/x509, mkcert, proper CA software) using default date encodings","Inspect the field: openssl x509 -in cert.pem -noout -startdate — if it errors or prints nonsense, the cert is broken","If a purchased cert is malformed, request reissue from the CA","Never hand-edit dates in a cert — re-sign instead"],"exampleFix":"# regenerate instead of patching dates\nopenssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj \"/CN=internal.local\"","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"function isCertErrorCode(e: unknown, code = \"ERROR_IN_CERT_NOT_BEFORE_FIELD\"): e is Error & { code: string } {\n  return e instanceof Error && (e as any).code === code;\n}","tryCatchPattern":"try {\n  await fetch(url);\n} catch (e) {\n  if (isCertErrorCode(e, \"ERROR_IN_CERT_NOT_BEFORE_FIELD\")) {\n    throw new Error(\"Peer certificate has a malformed notBefore field — regenerate it\");\n  }\n  throw e;\n}","preventionTips":["Generate certs only with openssl/mkcert/CA software — never hand-assembled scripts","Parse-test every issued cert (openssl x509 -noout -startdate) before deploying","For purchased certs, reject delivery if fields don't parse"],"tags":["tls","certificates","pkix","fetch"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}