Your Certificate Will Get Revoked if It Started More Than 48 Hours Before Actual Issuance
A certificate is considered backdated when its stated start date (notBefore) is more than 48 hours earlier than when it was actually signed - a CA/Browser Forum Baseline Requirements violation, and one the issuing CA must revoke within 5 days of discovering. The certificate works normally until that revocation happens, then browsers can reject it without further warning. SwissSign disclosed exactly this in September 2026, missing the limit by 38 minutes. TLS Radar checks the gap between a certificate's stated start date and its earliest independent timestamp on every scan, free or full.
If your certificate's start date is more than 48 hours earlier than when it was actually issued, industry rules call that backdated, and your certificate authority is required to revoke it within 5 days of finding out. Nothing is broken for your visitors today, and you didn't do anything wrong. The defect is in how your CA created the certificate. The deadline to fix it is real, and it's short.
What backdating actually means
Every certificate has a start date, called notBefore. It's supposed to be close to the moment the CA actually signs the certificate - industry rules allow up to 48 hours of gap, since CAs commonly round the start time down to midnight or the top of the hour to make renewals land on clean dates. A gap past that 48-hour allowance means the certificate was actually signed well after its stated start date, which is exactly what the rule exists to catch (CA/Browser Forum Baseline Requirements 7.1.2.7, in force since 2023-09-15).
A real example from September 2026
SwissSign disclosed a certificate with a notBefore of September 18, 2026 at 11:57:03 UTC that wasn't actually signed until September 20, 2026 at 12:35:51 UTC - a gap of 48 hours, 38 minutes, and 48 seconds, just 38 minutes past the limit (Mozilla Bugzilla 2074466). The CA caught it, disclosed it, and had to act on the same 5-day revocation clock every CA is bound by.
That 38-minute margin is why the check that catches this can't be generous with its own tolerance. Measured against a timestamp with any real slack built in, an incident this close to the line would pass unnoticed.
Why the timing matters more than the defect itself
Your certificate keeps working right up until your CA actually revokes it. There's no gradual warning. Once the CA revokes it, browsers can start rejecting it without further notice, the same as any other revoked certificate. Knowing about the backdating before that revocation lands means you can ask your CA to reissue on your own schedule, rather than finding out when a visitor already sees a warning.
Why you can't just switch to a different certificate
A backdated certificate also can't be worked around with a quick replacement from a different, free certificate authority. The validated organization details on your certificate live with the CA that issued it, so the reissue has to come from them.
What TLS Radar checks
TLS Radar checks this on every scan, free or full: the gap between your certificate's stated start date and the earliest independent record of when it was actually issued, taken from the certificate's own history in Certificate Transparency logs rather than anything the CA reports after the fact. If that gap is past the 48-hour allowance, we flag it, so you hear about a coming revocation from us instead of from your CA's notice or a visitor's bug report.
Check your certificate's issuance timing, no account required
See whether your certificate's start date lines up with when it was actually issued - along with everything else our scanner checks. Free, no account required.
Hear about a coming revocation before your CA's notice does
TLS Radar checks every certificate in your inventory for backdating on every scan, so you can ask for a reissue on your own timeline instead of scrambling after your CA's 5-day revocation deadline.
Related reading
Frequently asked questions
- What does it mean for a certificate to be backdated?
- It means the certificate's stated start date is more than 48 hours earlier than when the CA actually signed it - a violation of CA/Browser Forum Baseline Requirements 7.1.2.7. The issuing CA must revoke a backdated certificate within 5 days of discovering it.
- Is my site broken if my certificate was backdated?
- Not yet. A backdated certificate works normally for visitors until the CA actually revokes it. There's no gradual warning beforehand, so knowing about it before the revocation happens is what lets you control the timing of the replacement.
- Has this actually happened recently?
- Yes. SwissSign disclosed a certificate backdated by 48 hours and 38 minutes in September 2026, just 38 minutes past the allowed limit (Mozilla Bugzilla 2074466).
- Can I fix a backdated certificate with a free certificate from a different CA?
- Not directly. The validated organization details on your certificate live with the CA that issued it, so the reissue has to come from them, not a quick replacement elsewhere.
- Does TLS Radar check for this?
- Yes, on every scan, free or full. TLS Radar checks the gap between a certificate's stated start date and the earliest independent record of its issuance, and flags it if that gap is past the 48-hour allowance.
Get the next post in your inbox
TLS monitoring tips and product updates. No spam, unsubscribe anytime.