What causes "ERROR_IN_CERT_NOT_AFTER_FIELD" in oven-sh/bun?

Regenerate the certificate with mainstream tooling and re-serve the chain

oven-sh/bun · error · CertError

ERROR_IN_CERT_NOT_AFTER_FIELD

ERROR_IN_CERT_NOT_AFTER_FIELD

Error message

ERROR_IN_CERT_NOT_AFTER_FIELD

What it means

X509 verify result 14 (X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD): the certificate's notAfter (expiry) field is malformed and cannot be parsed, so validity cannot be determined. Mapped via get_cert_error_from_no (src/http/lib.rs:1533) to CertError::ERROR_IN_CERT_NOT_AFTER_FIELD (FetchTasklet.rs:1409 region).

Source

Thrown at src/http/error.rs:149

    #[error("UNABLE_TO_DECRYPT_CRL_SIGNATURE")]
    UNABLE_TO_DECRYPT_CRL_SIGNATURE,
    #[error("UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY")]
    UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY,
    #[error("CERT_SIGNATURE_FAILURE")]
    CERT_SIGNATURE_FAILURE,
    #[error("CRL_SIGNATURE_FAILURE")]
    CRL_SIGNATURE_FAILURE,
    #[error("CERT_NOT_YET_VALID")]
    CERT_NOT_YET_VALID,
    #[error("CERT_HAS_EXPIRED")]
    CERT_HAS_EXPIRED,
    #[error("CRL_NOT_YET_VALID")]
    CRL_NOT_YET_VALID,
    #[error("CRL_HAS_EXPIRED")]
    CRL_HAS_EXPIRED,
    #[error("ERROR_IN_CERT_NOT_BEFORE_FIELD")]
    ERROR_IN_CERT_NOT_BEFORE_FIELD,
    #[error("ERROR_IN_CERT_NOT_AFTER_FIELD")]
    ERROR_IN_CERT_NOT_AFTER_FIELD,
    #[error("ERROR_IN_CRL_LAST_UPDATE_FIELD")]
    ERROR_IN_CRL_LAST_UPDATE_FIELD,
    #[error("ERROR_IN_CRL_NEXT_UPDATE_FIELD")]
    ERROR_IN_CRL_NEXT_UPDATE_FIELD,
    #[error("OUT_OF_MEM")]
    OUT_OF_MEM,
    #[error("DEPTH_ZERO_SELF_SIGNED_CERT")]
    DEPTH_ZERO_SELF_SIGNED_CERT,
    #[error("SELF_SIGNED_CERT_IN_CHAIN")]
    SELF_SIGNED_CERT_IN_CHAIN,
    #[error("UNABLE_TO_GET_ISSUER_CERT_LOCALLY")]
    UNABLE_TO_GET_ISSUER_CERT_LOCALLY,
    #[error("UNABLE_TO_VERIFY_LEAF_SIGNATURE")]
    UNABLE_TO_VERIFY_LEAF_SIGNATURE,
    #[error("CERT_CHAIN_TOO_LONG")]
    CERT_CHAIN_TOO_LONG,
    #[error("CERT_REVOKED")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Regenerate the certificate with mainstream tooling and re-serve the chain
Validate the parsed expiry: openssl x509 -in cert.pem -noout -enddate
Replace any script that hand-assembles validity fields with openssl/mkcert or CA software
Ask the CA to reissue if a commercial cert is affected

Defensive patterns

Strategy: try-catch

Type guard

function isCertErrorCode(e: unknown, code = "ERROR_IN_CERT_NOT_AFTER_FIELD"): e is Error & { code: string } {
  return e instanceof Error && (e as any).code === code;
}

Try / catch

try {
  await fetch(url);
} catch (e) {
  if (isCertErrorCode(e, "ERROR_IN_CERT_NOT_AFTER_FIELD")) {
    throw new Error("Peer certificate has a malformed notAfter field — regenerate it");
  }
  throw e;
}

Prevention

Validate expiry parseability at issuance: openssl x509 -noout -enddate must succeed
Avoid exotic date values in cert generation tooling
Reissue rather than patching malformed certificates

When it happens

Trigger: TLS handshake where the leaf or a chain cert encodes an invalid expiry date (bad UTCTime/GeneralizedTime), almost always from a faulty issuing tool.

Common situations: Custom test-certificate generators emitting year 9999 or malformed dates, expired tooling that writes non-conformant encodings, corruption during PEM manipulation.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/c1e862f3fdc9226a. Report an issue: GitHub.