Each SSL certificate is valid starting from a specific date and up to the expiration date.

What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific date?


Historically, certificates have a start-of-validity date mostly for symmetry: they have an end-of-validity, so the original designers found it appropriate, for unspecified reasons, to include a start-of-validity date as well.

Nowadays, such dates have found a usage, which is past validation. That's what you do when you verify a signature several months/years after the deed. This is a complicated game with time stamps and projecting yourself in the past. The start-of-validity date then plays an important role (although hard to explain in a few paragraphs).

Of course, past validation is not at all the same context as a SSL connection, but they use the same format for certificates (X.509), and the start-of-validity field must be set. Usual CA set the start-of-validity at a few minutes or hours before the issuance date.


Provided that a CA has strong policies such that an issued certificate is never forward- or back- dated, then:

A certificate issued at the NotBeforeDate cannot have been compromised by vulnerabilities that are known to have been fixed before the NotBeforeDate - a certificate that does not exist during the period of a vulnerability cannot have been compromised by that vulnerability.

Conversely, if the existence of a novel vulnerability is discovered, any certificate issued prior to the discovery of new vulnerability might be regarded as suspect.

In other words, for fixed vulnerabilities the NotBeforeDate allows trust to be granted for certificates issued after the fix date. For discovered vulnerabilities, the NotBeforeDate allows trust to be revoked for certificates issued before the discovery date.


It could have several reason,

  • To check the contract/subscription of the client and CA
  • In case of attack, for resolving it could be useful to find out whether the attacker hijacked the data before having the secure connection or after.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.