dotvitals

TLS certificate is not valid yet

HighConfirmedQuick wintls.certificate.not-yet-valid

What this check looks for

The certificate's start date is in the future, so browsers reject it exactly as they would reject an expired one.

Why it matters

The site is unreachable now. The usual cause is a server clock that is wrong, which breaks far more than TLS — logs, tokens and scheduled jobs are all affected too.

When the check passes, your report says: “The certificate's start date has already passed”.

What it costs your score

When this check fails it removes 30 points from your TLS score, before the status, confidence and repeat multipliers are applied. TLS carries a weight of 15 in the overall score.

It shares the tls.certificate family ceiling of 60 points: however many findings that family produces, together they cannot remove more than that from TLS. One underlying problem showing up in several places is still one problem.

Severity
high
Default confidence
confirmed
Status when triggered
fail
Deduction
30 points
Family cap
tls.certificate · 60
Category
TLS
Module
Tls certificate
Fix owned by
user
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Correct the clock, then re-issue if the certificate really was issued early.

Until the start date passes, no validating client will accept the certificate.

  1. Check the server's time against a reliable source and enable NTP.

  2. If the clock was wrong at issuance, issue a replacement once time is correct.

How to confirm it worked

  • timedatectl status — expect 'System clock synchronized: yes'

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

nginx
timedatectl set-ntp true
timedatectl status
Technical detail

notBefore for ‹host› is in the future. RFC 5280 §6.1.3(a)(2) requires the current time to fall inside the validity window; a certificate outside it fails path validation regardless of its chain. Check the server's clock before re-issuing: a certificate issued by a host whose clock is fast will look not-yet-valid to everyone else.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the tls certificate checkerBuild the fix

Other tls certificate checks