Mandate +/- signing time for notBefore

docs/BR.md

@@ -2104,7 +2104,7 @@ CAs SHALL NOT include additional names unless the CA is aware of a reason for in
 | \ \ \ \ `signature`            | See [Section 7.1.3.2](#7132-signature-algorithmidentifier) |
 | \ \ \ \ `issuer`               | MUST be byte-for-byte identical to the `subject` field of the Issuing CA. See [Section 7.1.4.1](#7141-name-encoding) |
 | \ \ \ \ `validity`             | |
-| \ \ \ \ \ \ \ \ `notBefore`    | __**TBD**__ |
+| \ \ \ \ \ \ \ \ `notBefore`    | A value within 48 hours of the certificate signing operation. |
 | \ \ \ \ \ \ \ \ `notAfter`     | See [Section 6.3.2](#632-certificate-operational-periods-and-key-pair-usage-periods) |
 | \ \ \ \ `subject`              | See [Section 7.1.2.6.1](#71261-subscriber-certificate-types) |
 | \ \ \ \ `subjectPublicKeyInfo` | See [Section 7.1.3.1](#7131-subjectpublickeyinfo) |