gravitational/teleport · error

NotBefore > NotAfter

Error message

NotBefore > NotAfter

What it means

validateOverrideCertificate checks the certificate's own validity interval: NotBefore must not be after NotAfter. Such a certificate has an impossible validity window and can never be valid, so the library rejects it outright.

Source

Thrown at lib/subca/parsed.go:357

			certClusterName,
			clusterName,
		)
	}

	// Verify certificate constraints.
	switch {
	case !cert.IsCA:
		return errors.New("not a CA certificate (IsCA=false)")
	case !cert.BasicConstraintsValid:
		return errors.New("basic constraints not valid (BasicConstraintsValid=false)")
	case cert.KeyUsage&x509.KeyUsageCertSign == 0:
		// Usage names per Go 1.26.1.
		// https://cs.opensource.google/go/go/+/refs/tags/go1.26.1:src/crypto/x509/x509_string.go;l=23
		return errors.New("missing KeyUsage keyCertSign")
	case cert.KeyUsage&x509.KeyUsageCRLSign == 0:
		return errors.New("missing KeyUsage cRLSign")
	case cert.NotBefore.After(cert.NotAfter):
		return errors.New("NotBefore > NotAfter")
	}

	return nil
}

View on GitHub (pinned to 1283425b60)

Solutions

1. Re-issue the certificate with a valid window (NotBefore <= now, NotAfter > NotBefore).
2. Check the certificate dates with 'openssl x509 -in cert.pem -noout -dates' and compare them.
3. Audit the issuing tooling/system clock if the certificate was generated with a negative validity duration.

Example fix

// before (Go template)
NotBefore: time.Now(),
NotAfter:  time.Now().Add(-24 * time.Hour), // negative validity
// after
NotBefore: time.Now(),
NotAfter:  time.Now().Add(365 * 24 * time.Hour),

if cert.NotBefore.After(cert.NotAfter) {
    return errors.New("override cert has invalid validity window (NotBefore > NotAfter)")
}

When it happens

Trigger: Supplying an override certificate whose encoded NotBefore timestamp is later than its NotAfter timestamp, encountered when parsing it in ValidateAndParseCAOverride.

Common situations: Corrupted or hand-edited certificate files; misconfigured issuance tooling that computes the expiry from a wrong clock or negative duration; truncated/mangled PEM material.

Related errors

• chain not allowed with an empty certificate
• not a CA certificate (IsCA=false)
• basic constraints not valid (BasicConstraintsValid=false)
• missing KeyUsage keyCertSign
• nil certificate override

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/536ccabc47c36ad1. Report an issue: GitHub.