Commit 11d74515f2b for nodejs

commit 11d74515f2b571a3a6d70a5ff77ff8f143021e1d
Author: Sarthak Ahuja <39986642+SarthakAhuja@users.noreply.github.com>
Date:   Fri Nov 13 14:48:44 2026 +0530

    doc: document invalid X509Certificate validity times

    When a certificate's notBefore or notAfter time cannot be parsed,
    validFrom and validTo return the string 'Bad time value', and
    validFromDate and validToDate return an invalid Date. Relational
    comparisons with an invalid Date are always false, so a naive expiry
    check can treat such a certificate as valid. Document the current
    behavior and tell callers to reject invalid dates first.

    Signed-off-by: Sarthak Ahuja <39986642+SarthakAhuja@users.noreply.github.com>
    PR-URL: https://github.com/nodejs/node/pull/67406
    Refs: https://github.com/nodejs/node/issues/67285
    Reviewed-By: Filip Skokan <panva.ip@gmail.com>
    Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
    Reviewed-By: Tim Perry <pimterry@gmail.com>

diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index fad997430d3..54a2cbef52b 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -3517,6 +3517,9 @@ added: v15.6.0

 The date/time from which this certificate is valid.

+If the certificate's `notBefore` time cannot be parsed, this is the string
+`'Bad time value'`.
+
 ### `x509.validFromDate`

 <!-- YAML
@@ -3529,6 +3532,16 @@ added:

 The date/time from which this certificate is valid, encapsulated in a `Date` object.

+If the certificate's `notBefore` time cannot be parsed, this property is an
+invalid `Date` whose `getTime()` method returns `NaN`.
+
+Relational comparisons with an invalid `Date` evaluate to `false`. To check
+whether the current time is within the certificate's validity period, use
+`now >= x509.validFromDate && now <= x509.validToDate`. This expression
+evaluates to `false` if either date is invalid. Checking
+`now < x509.validFromDate || now > x509.validToDate` instead can fail to
+reject certificates with invalid dates.
+
 ### `x509.validTo`

 <!-- YAML
@@ -3539,6 +3552,9 @@ added: v15.6.0

 The date/time until which this certificate is valid.

+If the certificate's `notAfter` time cannot be parsed, this is the string
+`'Bad time value'`.
+
 ### `x509.validToDate`

 <!-- YAML
@@ -3551,6 +3567,16 @@ added:

 The date/time until which this certificate is valid, encapsulated in a `Date` object.

+If the certificate's `notAfter` time cannot be parsed, this property is an
+invalid `Date` whose `getTime()` method returns `NaN`.
+
+Relational comparisons with an invalid `Date` evaluate to `false`. To check
+whether the current time is within the certificate's validity period, use
+`now >= x509.validFromDate && now <= x509.validToDate`. This expression
+evaluates to `false` if either date is invalid. Checking
+`now < x509.validFromDate || now > x509.validToDate` instead can fail to
+reject certificates with invalid dates.
+
 ### `x509.signature`

 <!-- YAML