What causes "ERROR_IN_CERT_NOT_BEFORE_FIELD" in oven-sh/bun?

Regenerate the certificate with a standard tool (openssl req/x509, mkcert, proper CA software) using default date encodings

oven-sh/bun · error · CertError

ERROR_IN_CERT_NOT_BEFORE_FIELD

ERROR_IN_CERT_NOT_BEFORE_FIELD

Error message

ERROR_IN_CERT_NOT_BEFORE_FIELD

What it means

X509 verify result 13 (X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD): the notBefore field of the certificate is malformed — an unparseable/invalid UTCTime or GeneralizedTime value, so validity cannot even be evaluated. Mapped via get_cert_error_from_no (src/http/lib.rs:1532) to CertError::ERROR_IN_CERT_NOT_BEFORE_FIELD (FetchTasklet.rs:1409).

Source

Thrown at src/http/error.rs:147

    #[error("UNABLE_TO_DECRYPT_CERT_SIGNATURE")]
    UNABLE_TO_DECRYPT_CERT_SIGNATURE,
    #[error("UNABLE_TO_DECRYPT_CRL_SIGNATURE")]
    UNABLE_TO_DECRYPT_CRL_SIGNATURE,
    #[error("UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY")]
    UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY,
    #[error("CERT_SIGNATURE_FAILURE")]
    CERT_SIGNATURE_FAILURE,
    #[error("CRL_SIGNATURE_FAILURE")]
    CRL_SIGNATURE_FAILURE,
    #[error("CERT_NOT_YET_VALID")]
    CERT_NOT_YET_VALID,
    #[error("CERT_HAS_EXPIRED")]
    CERT_HAS_EXPIRED,
    #[error("CRL_NOT_YET_VALID")]
    CRL_NOT_YET_VALID,
    #[error("CRL_HAS_EXPIRED")]
    CRL_HAS_EXPIRED,
    #[error("ERROR_IN_CERT_NOT_BEFORE_FIELD")]
    ERROR_IN_CERT_NOT_BEFORE_FIELD,
    #[error("ERROR_IN_CERT_NOT_AFTER_FIELD")]
    ERROR_IN_CERT_NOT_AFTER_FIELD,
    #[error("ERROR_IN_CRL_LAST_UPDATE_FIELD")]
    ERROR_IN_CRL_LAST_UPDATE_FIELD,
    #[error("ERROR_IN_CRL_NEXT_UPDATE_FIELD")]
    ERROR_IN_CRL_NEXT_UPDATE_FIELD,
    #[error("OUT_OF_MEM")]
    OUT_OF_MEM,
    #[error("DEPTH_ZERO_SELF_SIGNED_CERT")]
    DEPTH_ZERO_SELF_SIGNED_CERT,
    #[error("SELF_SIGNED_CERT_IN_CHAIN")]
    SELF_SIGNED_CERT_IN_CHAIN,
    #[error("UNABLE_TO_GET_ISSUER_CERT_LOCALLY")]
    UNABLE_TO_GET_ISSUER_CERT_LOCALLY,
    #[error("UNABLE_TO_VERIFY_LEAF_SIGNATURE")]
    UNABLE_TO_VERIFY_LEAF_SIGNATURE,
    #[error("CERT_CHAIN_TOO_LONG")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Regenerate the certificate with a standard tool (openssl req/x509, mkcert, proper CA software) using default date encodings
Inspect the field: openssl x509 -in cert.pem -noout -startdate — if it errors or prints nonsense, the cert is broken
If a purchased cert is malformed, request reissue from the CA
Never hand-edit dates in a cert — re-sign instead

Example fix

# regenerate instead of patching dates
openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=internal.local"

Defensive patterns

Strategy: try-catch

Type guard

function isCertErrorCode(e: unknown, code = "ERROR_IN_CERT_NOT_BEFORE_FIELD"): e is Error & { code: string } {
  return e instanceof Error && (e as any).code === code;
}

Try / catch

try {
  await fetch(url);
} catch (e) {
  if (isCertErrorCode(e, "ERROR_IN_CERT_NOT_BEFORE_FIELD")) {
    throw new Error("Peer certificate has a malformed notBefore field — regenerate it");
  }
  throw e;
}

Prevention

Generate certs only with openssl/mkcert/CA software — never hand-assembled scripts
Parse-test every issued cert (openssl x509 -noout -startdate) before deploying
For purchased certs, reject delivery if fields don't parse

When it happens

Trigger: TLS handshake where the peer (or a CA in the chain) presents a certificate whose notBefore encodes an invalid date, typically from a broken homegrown cert generator.

Common situations: Self-signed certs made with hand-rolled scripts/openssl -startdate with bad formats, certs generated by buggy embedded tools or IoT firmware, or DER corruption of the validity section.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/a0c8d9f34255ea4c. Report an issue: GitHub.