HackBlue

Tools · Attack surface inventory · 17 / 23

httpx: the certificate date is not the probe time

A not-after value is when the certificate ends. The probe time is when you asked. Write both. Do not say the certificate expired at the moment of the probe unless the date is already past that time.

11 min read · practice only with authorization

Two clocks

When a probe records certificate details, not-after is the end time printed on the certificate. The probe time is when that request was made. They answer different questions. A certificate that ends next month was not expired during today’s probe.

A missing not-after means this line did not include it. Do not copy a date from a different URL on the same host and call it this response.

Past and future are comparisons you show

You may say the certificate’s end is before the probe time only after you write both timestamps and they compare that way. You may say it ends later only the same way. “Expires soon” is your threshold. Write the threshold. The line itself does not contain the word soon.

The issuer and subject, if present, are names on the certificate. They are not the probe time either.

What to file

File the URL, the probe time, and not-after as printed. If you compare them, show the comparison. If not-after was absent, say so. Do not replace not-after with the probe time.

Worked case: a future date called an outage

A line for https://status.hackblue-lab.org at probe time 2026-11-03T14:22:08Z shows not-after 2026-12-01T00:00:00Z. A draft says the certificate expired during the probe and the status page is down. The status on the same line is 200.

The note quotes both times. The certificate end is after the probe. The 200 is the response code. The outage sentence is removed. “Ends 2026-12-01” can stay, labeled as not-after, not as the time of the request.

Snippet
url: https://status.hackblue-lab.org
probe: 2026-11-03T14:22:08Z
not-after: 2026-12-01T00:00:00Z
status: 200
comparison: not-after is after the probe
not: expired during the probe

Diagram

Label each time

The certificate clock and the probe clock are not interchangeable.

  • Probe time

    When this request was made.

  • not-after

    When the certificate says it ends.

  • A comparison

    Only after both times are written.

  • Absent not-after

    This line did not include it. Do not borrow another URL’s date.

Check yourself

1. not-after is next month and the probe was today. What is true?

2. The line has no not-after. What do you write?

3. Who decides that an end date is “soon”?