Each SSL certificate is valid starting from a specific date and up to the expiration date.
What's the point in that "valid from" date? Why do we want a certificate to only be valid after a specific date?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Historically, certificates have a start-of-validity date mostly for symmetry: they have an end-of-validity, so the original designers found it appropriate, for unspecified reasons, to include a start-of-validity date as well.
Nowadays, such dates have found a usage, which is past validation. That's what you do when you verify a signature several months/years after the deed. This is a complicated game with time stamps and projecting yourself in the past. The start-of-validity date then plays an important role (although hard to explain in a few paragraphs).
Of course, past validation is not at all the same context as a SSL connection, but they use the same format for certificates (X.509), and the start-of-validity field must be set. Usual CA set the start-of-validity at a few minutes or hours before the issuance date.
Provided that a CA has strong policies such that an issued certificate is never forward- or back- dated, then:
A certificate issued at the NotBeforeDate cannot have been compromised by vulnerabilities that are known to have been fixed before the NotBeforeDate - a certificate that does not exist during the period of a vulnerability cannot have been compromised by that vulnerability.
Conversely, if the existence of a novel vulnerability is discovered, any certificate issued prior to the discovery of new vulnerability might be regarded as suspect.
In other words, for fixed vulnerabilities the NotBeforeDate allows trust to be granted for certificates issued after the fix date. For discovered vulnerabilities, the NotBeforeDate allows trust to be revoked for certificates issued before the discovery date.