Mark time before the notBefore time as expired as well as after the n…

…otAfter time.
xmidt-org · Nov 22, 2024 · a879f70 · a879f70
1 parent 356930f
commit a879f70
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/token/claimBuilder.go b/token/claimBuilder.go
@@ -230,7 +230,7 @@ func (cb *clientCertificateClaimBuilder) AddClaims(_ context.Context, r *Request
 		}
 
 		// special logic around expired certificates
-		expired := now.After(pc.NotAfter)
+		expired := now.Before(pc.NotBefore) || now.After(pc.NotAfter)
 		vo := x509.VerifyOptions{
 			// always set the current time so that we disambiguate expired
 			// from untrusted.