Asseco DS / Certum: Forward dating certificates (notBefore in the future)

RESOLVED FIXED Asseco Data Systems S.A.

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

The case was opened after Mozilla staff observed that Asseco DS / Certum forward-dates certificates by setting the notBefore date to a date in the future. The initial report cited examples where the notBefore appeared to be several days (and sometimes up to about a month) ahead of issuance, and it referenced Mozilla’s “Forbidden or Problematic Practices” section on backdating the notBefore date as a potentially related violation. Asseco DS / Certum responded that they allow setting notBefore up to 30 days forward to support server operators renewing TLS certificates without downtime, and they described how their renewal system design relates to this practice. They also stated they identified the risk of forward dating being used similarly to avoid regulations, and that they decided to stop supporting customer-provided future notBefore values. The thread notes that the change was implemented and tested, and later that a new application version was deployed to production on 2021-08-24, after which setting notBefore from the future became impossible for new certification requests. Mozilla indicated it would close the bug on 2021-09-10, and the bug is marked RESOLVED with resolution FIXED.

Model: gpt-5.4-nano Generated: 2026-06-13 21:28 UTC Revised: 2026-06-16 18:09 UTC Confidence: 0.50 9 comments

Chronology

2021-06-29 Bug opened regarding Asseco DS / Certum issuing certificates with notBefore dates in the future.
2021-08-24 Asseco DS / Certum deployed an application update that made future notBefore values impossible for new certification requests.
2021-09-10 Mozilla closed the bug after the update resolved the issue.

Thread Activity

2021-06-29 Community commenter — Reported that Asseco DS / Certum forward-dates certificates by setting notBefore to a future date and requested an explanation of policies, history, analysis, and monitoring.
2021-06-30 Assecods representative — Acknowledged they would prepare a reply as soon as possible.
2021-07-02 Asseco Data Systems S.A. — Explained they allow notBefore up to 30 days forward for renewal use cases, discussed related risk management, and stated they decided to stop supporting future notBefore values; described roadmap and planned installation.
2021-07-09 Asseco Data Systems S.A. — Said there were no updates.
2021-07-16 Assecods representative — Said there were no updates.
2021-07-26 Assecods representative — Said there were no updates.
2021-07-27 Asseco Data Systems S.A. — Asked Ben to set the next update date to 2021-08-31, noting production installation planned for the second half of August.
2021-08-26 Asseco Data Systems S.A. — Reported the new application version was deployed on 2021-08-24 and that setting notBefore from the future is impossible for new requests.
2021-09-07 Mozilla representative — Stated they would close the bug on Friday, 10-Sept-2021.

Participants

Community commenter Assecods representative Asseco Data Systems S.A. Mozilla representative

External References

Original Bugzilla Case crt.sh crt.sh groups.google.com wiki.mozilla.org bugzilla.mozilla.org lists.cabforum.org lists.cabforum.org github.com

Related Bugzilla IDs Mentioned

#1705657

Similar Local Cases

#1524878 RESOLVED Certificate Misissuance Duplicate Or Superseded Opened 2019-02-03 · Closed 2023-02-22 · 61% similar

Asseco DS / Certum: IP in dnsName

AI Summary CA Owner

#1710206 RESOLVED Externally Reported Incident Certificate Misissuance Opened 2021-05-08 · Closed 2022-11-14 · 60% similar

Asseco DS / Certum: Incorrect localityName

AI Summary CA Owner

#2002281 RESOLVED Ca Certificate Compliance Opened 2025-11-25 · Closed 2025-12-11 · 52% similar

Asseco DS / Certum: Irregularities in Xinchacha/Xcc Brand SSL Certificates

AI Summary CA Owner

#1717034 RESOLVED Ca Documents Policy Document Issue Opened 2021-06-17 · Closed 2023-02-22 · 49% similar

Asseco DS / Certum: CPS does not refer to BR domain validation methods

AI Summary CA Owner

#1667684 RESOLVED Self Reported Incident Opened 2020-09-27 · Closed 2023-02-22 · 48% similar

Asseco DS / Certum: Failure to provide a preliminary report within 24 hours.

AI Summary CA Owner

#1667986 RESOLVED Delayed Revocation Opened 2020-09-29 · Closed 2023-02-22 · 48% similar

Asseco DS / Certum: Invalid stateOrProvinceName field

AI Summary CA Owner

#1639502 RESOLVED Self Reported Incident Opened 2020-05-20 · Closed 2023-02-22 · 47% similar

Asseco DS / Certum: Incorrect OCSP response encoding

AI Summary CA Owner

#1668523 RESOLVED Delayed Revocation Revocation Issue Opened 2020-10-01 · Closed 2023-02-22 · 47% similar

Asseco DS / Certum: Failure to revoke within 5 days

AI Summary CA Owner