From 0baec3014c910078830036827c5a8eaed42056cf Mon Sep 17 00:00:00 2001
From: Sarthak Ahuja <39986642+SarthakAhuja@users.noreply.github.com>
Date: Wed, 11 Nov 2026 13:47:59 +0530
Subject: [PATCH 1/3] doc: document invalid X509Certificate validity times

When a certificate's notBefore or notAfter time cannot be parsed,
validFrom and validTo return the string 'Bad time value', and
validFromDate and validToDate return an invalid Date. Relational
comparisons with an invalid Date are always false, so a naive expiry
check can treat such a certificate as valid. Document the current
behavior and tell callers to reject invalid dates first.

Signed-off-by: Sarthak Ahuja <39986642+SarthakAhuja@users.noreply.github.com>
---
 doc/api/crypto.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index b14c4876884f..8fa48a382bbf 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -3517,6 +3517,9 @@ added: v15.6.0
 
 The date/time from which this certificate is valid.
 
+If the certificate's `notBefore` time cannot be parsed, this is the string
+`'Bad time value'`.
+
 ### `x509.validFromDate`
 
 <!-- YAML
@@ -3529,6 +3532,11 @@ added:
 
 The date/time from which this certificate is valid, encapsulated in a `Date` object.
 
+If the certificate's `notBefore` time cannot be parsed, this is an invalid
+`Date` (its `getTime()` method returns `NaN`). Every relational comparison
+with an invalid `Date` evaluates to `false`, so callers should reject an
+invalid `Date` before comparing it with other dates.
+
 ### `x509.validTo`
 
 <!-- YAML
@@ -3539,6 +3547,9 @@ added: v15.6.0
 
 The date/time until which this certificate is valid.
 
+If the certificate's `notAfter` time cannot be parsed, this is the string
+`'Bad time value'`.
+
 ### `x509.validToDate`
 
 <!-- YAML
@@ -3551,6 +3562,11 @@ added:
 
 The date/time until which this certificate is valid, encapsulated in a `Date` object.
 
+If the certificate's `notAfter` time cannot be parsed, this is an invalid
+`Date` (its `getTime()` method returns `NaN`). Every relational comparison
+with an invalid `Date` evaluates to `false`, so callers should reject an
+invalid `Date` before comparing it with other dates.
+
 ### `x509.signature`
 
 <!-- YAML

From 02ed95ddb10d4016eea575768cc94b106178807f Mon Sep 17 00:00:00 2001
From: Sarthak Ahuja <39986642+SarthakAhuja@users.noreply.github.com>
Date: Wed, 11 Nov 2026 15:00:35 +0530
Subject: [PATCH 2/3] doc: recommend in-window X509Certificate validity check

Per review, tell callers to test that the current time is inside the
validity window, which rejects an invalid bound, instead of testing
whether it is outside the window, which an invalid bound passes.

Signed-off-by: Sarthak Ahuja <39986642+SarthakAhuja@users.noreply.github.com>
---
 doc/api/crypto.md | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 8fa48a382bbf..fa819f801bb5 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -3534,8 +3534,12 @@ The date/time from which this certificate is valid, encapsulated in a `Date` obj
 
 If the certificate's `notBefore` time cannot be parsed, this is an invalid
 `Date` (its `getTime()` method returns `NaN`). Every relational comparison
-with an invalid `Date` evaluates to `false`, so callers should reject an
-invalid `Date` before comparing it with other dates.
+with an invalid `Date` evaluates to `false`. To check whether a certificate
+is currently valid, test that the current time is inside the validity window
+(`now >= x509.validFromDate && now <= x509.validToDate`), which rejects an
+invalid bound. Do not test whether it is outside the window
+(`now < x509.validFromDate || now > x509.validToDate`): with an invalid
+bound, that test is `false` and the certificate appears valid.
 
 ### `x509.validTo`
 
@@ -3564,8 +3568,12 @@ The date/time until which this certificate is valid, encapsulated in a `Date` ob
 
 If the certificate's `notAfter` time cannot be parsed, this is an invalid
 `Date` (its `getTime()` method returns `NaN`). Every relational comparison
-with an invalid `Date` evaluates to `false`, so callers should reject an
-invalid `Date` before comparing it with other dates.
+with an invalid `Date` evaluates to `false`. To check whether a certificate
+is currently valid, test that the current time is inside the validity window
+(`now >= x509.validFromDate && now <= x509.validToDate`), which rejects an
+invalid bound. Do not test whether it is outside the window
+(`now < x509.validFromDate || now > x509.validToDate`): with an invalid
+bound, that test is `false` and the certificate appears valid.
 
 ### `x509.signature`
 

From 33ca48a8932f2c681940320ebeeb51cf39f75c30 Mon Sep 17 00:00:00 2001
From: Sarthak Ahuja <39986642+SarthakAhuja@users.noreply.github.com>
Date: Wed, 11 Nov 2026 15:32:09 +0530
Subject: [PATCH 3/3] doc: use reviewer wording for X509Certificate dates

Apply the review suggestions for validFromDate and validToDate.

Signed-off-by: Sarthak Ahuja <39986642+SarthakAhuja@users.noreply.github.com>
---
 doc/api/crypto.md | 34 ++++++++++++++++++----------------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index fa819f801bb5..fadaa4d200dc 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -3532,14 +3532,15 @@ added:
 
 The date/time from which this certificate is valid, encapsulated in a `Date` object.
 
-If the certificate's `notBefore` time cannot be parsed, this is an invalid
-`Date` (its `getTime()` method returns `NaN`). Every relational comparison
-with an invalid `Date` evaluates to `false`. To check whether a certificate
-is currently valid, test that the current time is inside the validity window
-(`now >= x509.validFromDate && now <= x509.validToDate`), which rejects an
-invalid bound. Do not test whether it is outside the window
-(`now < x509.validFromDate || now > x509.validToDate`): with an invalid
-bound, that test is `false` and the certificate appears valid.
+If the certificate's `notBefore` time cannot be parsed, this property is an
+invalid `Date` whose `getTime()` method returns `NaN`.
+
+Relational comparisons with an invalid `Date` evaluate to `false`. To check
+whether the current time is within the certificate's validity period, use
+`now >= x509.validFromDate && now <= x509.validToDate`. This expression
+evaluates to `false` if either date is invalid. Checking
+`now < x509.validFromDate || now > x509.validToDate` instead can fail to
+reject certificates with invalid dates.
 
 ### `x509.validTo`
 
@@ -3566,14 +3567,15 @@ added:
 
 The date/time until which this certificate is valid, encapsulated in a `Date` object.
 
-If the certificate's `notAfter` time cannot be parsed, this is an invalid
-`Date` (its `getTime()` method returns `NaN`). Every relational comparison
-with an invalid `Date` evaluates to `false`. To check whether a certificate
-is currently valid, test that the current time is inside the validity window
-(`now >= x509.validFromDate && now <= x509.validToDate`), which rejects an
-invalid bound. Do not test whether it is outside the window
-(`now < x509.validFromDate || now > x509.validToDate`): with an invalid
-bound, that test is `false` and the certificate appears valid.
+If the certificate's `notAfter` time cannot be parsed, this property is an
+invalid `Date` whose `getTime()` method returns `NaN`.
+
+Relational comparisons with an invalid `Date` evaluate to `false`. To check
+whether the current time is within the certificate's validity period, use
+`now >= x509.validFromDate && now <= x509.validToDate`. This expression
+evaluates to `false` if either date is invalid. Checking
+`now < x509.validFromDate || now > x509.validToDate` instead can fail to
+reject certificates with invalid dates.
 
 ### `x509.signature`