How the tools word it
| Node 26 tls | CERT_NOT_YET_VALID: certificate is not yet valid |
|---|---|
| OpenSSL 3.6 s_client | verify error:num=9:certificate is not yet valid or the system clock is incorrect |
| OpenSSL 3.6 verify | error 9 at 0 depth lookup: certificate is not yet valid or the system clock is incorrect |
| curl 8.23 | curl: (60) SSL certificate OpenSSL verify result: certificate is not yet valid or the system clock is incorrect (9) |
| Python 3.14 ssl | ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate is not yet valid or the system clock is incorrect (_ssl.c:1082) |
Common causes
The Not before date really is in the future
This certificate starts on 1 January 2099. The Decoder compares the date with your device's clock and says Not valid yet, and how long until it starts. Outside tests this is rare: a certificate made ahead of a planned switch, or with a wrong date.
Input
-----BEGIN CERTIFICATE----- MIIB9DCCAZmgAwIBAgIBCDAKBggqhkjOPQQDAjBBMRgwFgYDVQQKDA9mam9yZHRv b2xzIHRlc3QxJTAjBgNVBAMMHGZqb3JkdG9vbHMgdGVzdCBpbnRlcm1lZGlhdGUw IhgPMjA5OTAxMDEwMDAwMDBaGA8yMTAwMDEwMTAwMDAwMFowMDEYMBYGA1UECgwP ZmpvcmR0b29scyB0ZXN0MRQwEgYDVQQDDAtzZXJ2ZXIudGVzdDBZMBMGByqGSM49 AgEGCCqGSM49AwEHA0IABO3ntfTu/Mqpsjgecf4eCu/0AOmFt9lyXrCU/Jb9kPmN BgUeHq9g6Ss5V3DUORu1TfRpM7bs0p13If8Cq9/BUHajgY4wgYswDAYDVR0TAQH/ BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwFgYDVR0R BA8wDYILc2VydmVyLnRlc3QwHQYDVR0OBBYEFPx46kYC4FBEEA569cvJ4QnG9m2q MB8GA1UdIwQYMBaAFDLe0Q57+hCR3CrKO23d1VmQvZK6MAoGCCqGSM49BAMCA0kA MEYCIQCFZOkf/WQ40BmmfLKmgc0/0tUtesrmPAxYDyQ7mNhGRQIhAPVc9uPr1n2Y dezI/w3eCYayQRfdwBbg6EU+1ersfkj+ -----END CERTIFICATE-----
Certificate Decoder says
Not valid yet · Not before 2099-01-01 00:00:00 UTC
A certificate above the leaf is not valid yet
The error does not say which certificate. OpenSSL names the depth: at 0 is the server's own certificate, a higher number is an issuer. In this chain the intermediate starts in 2099, so the leaf is fine and the client still refuses. Paste the whole chain and the status line counts the certificates that are not valid yet.
Input
-----BEGIN CERTIFICATE----- MIIB7jCCAZWgAwIBAgIBBDAKBggqhkjOPQQDAjBBMRgwFgYDVQQKDA9mam9yZHRv b2xzIHRlc3QxJTAjBgNVBAMMHGZqb3JkdG9vbHMgdGVzdCBpbnRlcm1lZGlhdGUw HhcNMjYwMTAxMDAwMDAwWhcNMzYwMTAxMDAwMDAwWjAwMRgwFgYDVQQKDA9mam9y ZHRvb2xzIHRlc3QxFDASBgNVBAMMC3NlcnZlci50ZXN0MFkwEwYHKoZIzj0CAQYI KoZIzj0DAQcDQgAE7ee19O78yqmyOB5x/h4K7/QA6YW32XJesJT8lv2Q+Y0GBR4e r2DpKzlXcNQ5G7VN9GkztuzSnXch/wKr38FQdqOBjjCBizAMBgNVHRMBAf8EAjAA MA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAWBgNVHREEDzAN ggtzZXJ2ZXIudGVzdDAdBgNVHQ4EFgQU/HjqRgLgUEQQDnr1y8nhCcb2baowHwYD VR0jBBgwFoAUMt7RDnv6EJHcKso7bd3VWZC9krowCgYIKoZIzj0EAwIDRwAwRAIg VatubrykL+ZDu2wIXIFzNCA4G6SIsUQnf2mw4c30KXMCICf1jBo0UciVihHiS1KE k6cc1SY9pCBuOPjwOoiC3ob3 -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIB0zCCAXmgAwIBAgIBCzAKBggqhkjOPQQDAjA5MRgwFgYDVQQKDA9mam9yZHRv b2xzIHRlc3QxHTAbBgNVBAMMFGZqb3JkdG9vbHMgdGVzdCByb290MCIYDzIwOTkw MTAxMDAwMDAwWhgPMjEwMDAxMDEwMDAwMDBaMEExGDAWBgNVBAoMD2Zqb3JkdG9v bHMgdGVzdDElMCMGA1UEAwwcZmpvcmR0b29scyB0ZXN0IGludGVybWVkaWF0ZTBZ MBMGByqGSM49AgEGCCqGSM49AwEHA0IABPEvpZWB8iOtcDVD49Az4aSMhfoUcTO3 SRUHaJZBBaZTvC1Ql8u0YB8UbbUwz/jndpCVdrZnV60F3izzBjqxtAujZjBkMBIG A1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBQy3tEO e/oQkdwqyjtt3dVZkL2SujAfBgNVHSMEGDAWgBS3IPTLNvG7LF9oRAtormf5Y/T+ KDAKBggqhkjOPQQDAgNIADBFAiEA8ICkR66x5GKphmj5O7/dzZG3ijnlsT7mNZlL 4CKtMAgCIDOFnBJFPiY0tvxQNJU11xgnpb/NFMr/18e6zmee4bcO -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIBwzCCAWqgAwIBAgIBATAKBggqhkjOPQQDAjA5MRgwFgYDVQQKDA9mam9yZHRv b2xzIHRlc3QxHTAbBgNVBAMMFGZqb3JkdG9vbHMgdGVzdCByb290MB4XDTI2MDEw MTAwMDAwMFoXDTM2MDEwMTAwMDAwMFowOTEYMBYGA1UECgwPZmpvcmR0b29scyB0 ZXN0MR0wGwYDVQQDDBRmam9yZHRvb2xzIHRlc3Qgcm9vdDBZMBMGByqGSM49AgEG CCqGSM49AwEHA0IABH0DdyM4j2Qm5yUYrP9opJIyAW5oKmYs1KlgD5QaEspetzDt LmYCaEdSk051mmCgtov0ROqWiElrHplTLeJ0vQWjYzBhMB8GA1UdIwQYMBaAFLcg 9Ms28bssX2hEC2iuZ/lj9P4oMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQD AgEGMB0GA1UdDgQWBBS3IPTLNvG7LF9oRAtormf5Y/T+KDAKBggqhkjOPQQDAgNH ADBEAiBJvWgbvsYiq9JtmZfKyepnmBnyzFQ93G+Tu9MHiZSt9wIgLz6fgDWJkUSD djhBBe3H4vsZwwTf+tNiFatZWY+Bkno= -----END CERTIFICATE-----
Certificate Decoder says
3 certificates, 1 not valid yet
The certificate is fine and the client's clock is behind
A virtual machine, a CI runner, a container host or a device whose clock was reset can believe it is an earlier date. If the Decoder says Valid and the client says not yet valid, check the client's date.
Input
-----BEGIN CERTIFICATE----- MIIB7jCCAZWgAwIBAgIBBDAKBggqhkjOPQQDAjBBMRgwFgYDVQQKDA9mam9yZHRv b2xzIHRlc3QxJTAjBgNVBAMMHGZqb3JkdG9vbHMgdGVzdCBpbnRlcm1lZGlhdGUw HhcNMjYwMTAxMDAwMDAwWhcNMzYwMTAxMDAwMDAwWjAwMRgwFgYDVQQKDA9mam9y ZHRvb2xzIHRlc3QxFDASBgNVBAMMC3NlcnZlci50ZXN0MFkwEwYHKoZIzj0CAQYI KoZIzj0DAQcDQgAE7ee19O78yqmyOB5x/h4K7/QA6YW32XJesJT8lv2Q+Y0GBR4e r2DpKzlXcNQ5G7VN9GkztuzSnXch/wKr38FQdqOBjjCBizAMBgNVHRMBAf8EAjAA MA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAWBgNVHREEDzAN ggtzZXJ2ZXIudGVzdDAdBgNVHQ4EFgQU/HjqRgLgUEQQDnr1y8nhCcb2baowHwYD VR0jBBgwFoAUMt7RDnv6EJHcKso7bd3VWZC9krowCgYIKoZIzj0EAwIDRwAwRAIg VatubrykL+ZDu2wIXIFzNCA4G6SIsUQnf2mw4c30KXMCICf1jBo0UciVihHiS1KE k6cc1SY9pCBuOPjwOoiC3ob3 -----END CERTIFICATE-----
Certificate Decoder says
Valid · Not after 2036-01-01 00:00:00 UTC
How to fix it
- Read the dates. openssl x509 -noout -startdate -in cert.pem prints the Not before date, and the Certificate Decoder shows it with the time until it starts.
- Check the client's own clock: date -u prints the time in UTC on Linux and macOS. Keep time synchronisation (NTP) on, and check a virtual machine that was paused or restored.
- To test a certificate against another moment, give openssl verify a Unix time: openssl verify -attime 1767312000 -CAfile root.crt -untrusted int.crt leaf.crt. It fails before the Not before date and passes after it.
- If the certificate really starts later, wait, or have it reissued so that it is valid from now. Do not turn certificate checking off.