crypto/x509: InvalidReason.Expired is misleading for not-yet-valid certificates

[GenFlogi]

What version of Go are you using?

1.25.3

What did you expect to see?

Different InvalidReason constants for "expired" vs "not yet valid" certificates,
as these are semantically different conditions.

What did you see instead?

Both conditions use InvalidReason.Expired, which is misleading since "expired"
in English implies something was valid but no longer is, not something that
hasn't become valid yet.

Proposal:

Add a new InvalidReason constant "NotYetValid" to distinguish between:

• Certificates that have expired (after NotAfter)
• Certificates that are not yet valid (before NotBefore)

This would make error handling more precise and the API clearer.

I would be happy to help implement this and to create a pull request

[gabyhelp]

Related Issues

• crypto/x509: add Detail to Expired errors #34646 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[GenFlogi]

I think this would further harden the error handling, since it allows for specificy case checking instead of checking the text or the NotBefore field

[dr2chase]

@golang/security