The validity field defines when an X.509 certificate may be trusted or used. Its two timestamps are Not Before (notBefore), when validity begins, and Not After (notAfter), when the certificate expires. A certificate is valid only when the current time falls within that interval. section 8.1.6 section 8.3
A certificate’s usable window
A GitHub certificate shows Not Before: February 14, 2023 at 00:00 GMT and Not After: March 14, 2024 at 23:59:59 GMT. Before the first timestamp it is not usable; after the second it is expired. section 8.1.6
openssl x509 -in github-cert.pem -noout -dates
Inspect a certificate’s validity dates directly with OpenSSL; the output reports its notBefore and notAfter values. section 8.1.6
Treat the validity period as both a trust boundary and an operational concern:
- Avoid certificates that last longer than necessary: a longer lifetime gives a stolen, leaked, or lost private key more time to be abused. section 8.1.6
- Match the lifetime to the use case: Sigstore code-signing certificates may last 10 minutes, while Let’s Encrypt certificates commonly last 90 days. section 8.1.6
- Remember that validity is one part of certificate validation; verification also considers signatures and whether the issuing CA is trusted. section 8.4
