dgraph-io/dgraph · error

--duration: certificate expiration date '%s' exceeds parent

Error message

--duration: certificate expiration date '%s' exceeds parent '%s'

What it means

In generatePair (dgraph/cmd/cert/cert.go:103), the Dgraph cert tool refuses to create a certificate whose NotAfter would outlive its signing parent CA. When a --duration/until value produces a template expiration later than the parent's NotAfter, the resulting chain would be invalid, so the tool fails fast before calling x509.CreateCertificate. It applies whenever a node or client cert is generated under an existing CA.

Source

Thrown at dgraph/cmd/cert/cert.go:103

			} else {
				template.DNSNames = append(template.DNSNames, h)
			}
		}

	case c.client != "":
		template.Subject.CommonName = c.client
		template.KeyUsage = x509.KeyUsageDigitalSignature
		template.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}
	}

	if c.signer == nil {
		c.signer = key
	}

	if c.parent == nil {
		c.parent = template
	} else if template.NotAfter.After(c.parent.NotAfter) {
		return errors.Errorf("--duration: certificate expiration date '%s' exceeds parent '%s'",
			template.NotAfter, c.parent.NotAfter)
	}

	der, err := x509.CreateCertificate(rand.Reader,
		template, c.parent, key.Public(), c.signer)
	if err != nil {
		return err
	}

	fp, err := safeCreate(certFile, c.force, 0666)
	if err != nil {
		// check the existing cert.
		if os.IsExist(err) {
			_, err = readCert(certFile)
		}
		return err
	}
	defer func() {

View on GitHub (pinned to 759e242be6)

Solutions

1. Pass a smaller --duration to dgraph cert so the new cert expires before the parent CA.
2. Regenerate the root CA (dgraph cert --ca --force) with the longer lifetime, then re-issue node and client certs.
3. Check the parent CA's expiry (`dgraph cert --info` or openssl x509 -enddate) before choosing --duration.

Example fix

// before
dgraph cert --ca_certs ca.crt --client --duration 87600  // 10y leaf under 1y CA
// after
dgraph cert --ca_certs ca.crt --client --duration 8760   // fits within CA lifetime

// Check parent CA expiry before requesting a leaf cert with a given duration
caCert, err := readCert("ca.crt")
if err != nil { return err }
requested := time.Now().AddDate(0, 0, until)
if requested.After(caCert.NotAfter) {
    return fmt.Errorf("--duration %dd exceeds CA expiry %s", until, caCert.NotAfter)
}

if err := createClientPair(...); err != nil {
    if strings.Contains(err.Error(), "exceeds parent") {
        // reduce --duration or renew the CA, then retry
    }
    return err
}

When it happens

Trigger: Running `dgraph cert` (createNodePair/createClientPair) with a --duration (until) flag large enough that time.Now()+duration exceeds the NotAfter of the existing root CA, e.g. creating a new node/client cert with --duration 87600 after the CA was created with a shorter duration.

Common situations: Operator created a CA with a 1-year duration, later regenerates leaf certs with the default or a longer duration; script reruns `dgraph cert --nodes --client` months after the CA was issued with a shorter lifetime; user assumes leaf cert duration is independent of the CA.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• %s: verification failed
• could not read parent cert

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/18c0a0dfecf33c35. Report an issue: GitHub.