k3s-io/k3s · error

%s/%s: certificate %s is not valid before %s

Error message

%s/%s: certificate %s is not valid before %s

What it means

Error "%s/%s: certificate %s is not valid before %s" thrown in k3s-io/k3s.

Source

Thrown at pkg/certmonitor/certmonitor.go:131

}

func checkCerts(fileMap map[string][]string, warningPeriod time.Duration) error {
	errs := []error{}
	now := time.Now()
	warn := now.Add(warningPeriod)

	for service, files := range fileMap {
		for _, file := range files {
			basename := filepath.Base(file)
			certs, _ := certutil.CertsFromFile(file)
			for _, cert := range certs {
				usages := util.GetCertUsages(cert)
				certificateExpirationSeconds.WithLabelValues(cert.Subject.String(), strings.Join(usages, ",")).Set(cert.NotAfter.Sub(now).Seconds())
				status := util.GetCertStatus(cert, now, warn)
				if status != util.CertStatusOK {
					switch status {
					case util.CertStatusNotYetValid:
						errs = append(errs, fmt.Errorf("%s/%s: certificate %s is not valid before %s", service, basename, cert.Subject, cert.NotBefore.Format(time.RFC3339)))
					case util.CertStatusExpired:
						errs = append(errs, fmt.Errorf("%s/%s: certificate %s expired at %s", service, basename, cert.Subject, cert.NotAfter.Format(time.RFC3339)))
					case util.CertStatusWarning:
						errs = append(errs, fmt.Errorf("%s/%s: certificate %s will expire within %d days at %s", service, basename, cert.Subject, int(warningPeriod.Hours()/24), cert.NotAfter.Format(time.RFC3339)))
					}
				}
			}
		}
	}

	return errors.Join(errs...)
}

View on GitHub (pinned to 6ba341e396)

When it happens

Trigger: Thrown at pkg/certmonitor/certmonitor.go:131 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/074bb3465e762a95. Report an issue: GitHub.