SensitiveDate Validator

certmonitor.validators.sensitive_date.SensitiveDateValidator

Bases: BaseCertValidator

A validator for checking if an SSL certificate expires on a sensitive/special date.

Attributes:

Name	Type	Description
name	str	The name of the validator.

name class-attribute instance-attribute

name = 'sensitive_date'

validate

validate(cert: Dict[str, Any], host: str, port: int, *, dates: Optional[List[SensitiveDateInput]] = None) -> Dict[str, Any]

Validates the sensitivity of the expiry date of the provided SSL certificate.

Parameters:

Name	Type	Description	Default
cert	dict	The SSL certificate.	required
host	str	The hostname (not used in this validator).	required
port	int	The port number (not used in this validator).	required
dates	list	Sensitive dates to match against the certificate's expiration date. Each entry may be a SensitiveDate, a plain date / datetime, an ISO date string ("2025-12-25"), or a (name, date) tuple. Defaults to None (no sensitive-date matching; weekend and leap-day checks still run).	None

Returns:

Name	Type	Description
dict	Dict[str, Any]	A dictionary containing: is_valid (bool): True iff none of the checks fired. leapday_expiry (bool): certificate expires on Feb 29. weekend_expiry (bool): certificate expires on Saturday/Sunday. sensitive_date_matches (list): structured records of any user-supplied dates that matched, each with name and date (ISO 8601 string). warnings (list of str): human-readable summary lines for every condition that fired.

Examples:

Example output (success):

```json
{
    "is_valid": true,
    "leapday_expiry": false,
    "weekend_expiry": false,
    "sensitive_date_matches": [],
    "warnings": []
}
```

Example output (failure):

```json
{
    "is_valid": false,
    "leapday_expiry": false,
    "weekend_expiry": true,
    "sensitive_date_matches": [
        {"name": "Busy Sunday", "date": "2025-11-16"}
    ],
    "warnings": [
        "Certificate expires on a weekend (Sunday)",
        "Certificate is due to expire on sensitive date \"Busy Sunday\" (2025-11-16)"
    ]
}
```

Source code in certmonitor/validators/sensitive_date.py

def validate(
    self,
    cert: Dict[str, Any],
    host: str,
    port: int,
    *,
    dates: Optional[List[SensitiveDateInput]] = None,
) -> Dict[str, Any]:
    """
    Validates the sensitivity of the expiry date of the provided SSL certificate.

    Args:
        cert (dict): The SSL certificate.
        host (str): The hostname (not used in this validator).
        port (int): The port number (not used in this validator).
        dates (list, optional): Sensitive dates to match against the
            certificate's expiration date. Each entry may be a
            ``SensitiveDate``, a plain ``date`` / ``datetime``, an ISO date
            string (``"2025-12-25"``), or a ``(name, date)`` tuple.
            Defaults to ``None`` (no sensitive-date matching; weekend and
            leap-day checks still run).

    Returns:
        dict: A dictionary containing:

            - ``is_valid`` (bool): ``True`` iff none of the checks fired.
            - ``leapday_expiry`` (bool): certificate expires on Feb 29.
            - ``weekend_expiry`` (bool): certificate expires on Saturday/Sunday.
            - ``sensitive_date_matches`` (list): structured records of any
              user-supplied dates that matched, each with ``name`` and
              ``date`` (ISO 8601 string).
            - ``warnings`` (list of str): human-readable summary lines for
              every condition that fired.

    Examples:
        Example output (success):

            ```json
            {
                "is_valid": true,
                "leapday_expiry": false,
                "weekend_expiry": false,
                "sensitive_date_matches": [],
                "warnings": []
            }
            ```

        Example output (failure):

            ```json
            {
                "is_valid": false,
                "leapday_expiry": false,
                "weekend_expiry": true,
                "sensitive_date_matches": [
                    {"name": "Busy Sunday", "date": "2025-11-16"}
                ],
                "warnings": [
                    "Certificate expires on a weekend (Sunday)",
                    "Certificate is due to expire on sensitive date \\"Busy Sunday\\" (2025-11-16)"
                ]
            }
            ```
    """
    normalized: List[SensitiveDate] = []
    if dates:
        for item in dates:
            try:
                normalized.append(_normalize(item))
            except (TypeError, ValueError) as exc:
                return {
                    "is_valid": False,
                    "reason": f"Invalid sensitive date input: {exc}",
                    "leapday_expiry": False,
                    "weekend_expiry": False,
                    "sensitive_date_matches": [],
                    "warnings": [],
                }

    not_after = parse_not_after(cert)
    expiry_date = not_after.date()
    weekday = not_after.weekday()

    leapday_expiry = expiry_date.month == 2 and expiry_date.day == 29
    weekend_expiry = weekday in (5, 6)

    warnings: List[str] = []
    if leapday_expiry:
        warnings.append(
            f"Certificate expires on a leap day ({expiry_date.isoformat()})"
        )
    if weekend_expiry:
        day_name = "Saturday" if weekday == 5 else "Sunday"
        warnings.append(f"Certificate expires on a weekend ({day_name})")

    sensitive_date_matches: List[Dict[str, str]] = []
    for sd in normalized:
        if expiry_date == sd.date:
            sensitive_date_matches.append(
                {"name": sd.name, "date": sd.date.isoformat()}
            )
            warnings.append(
                f'Certificate is due to expire on sensitive date "{sd.name}"'
                f" ({sd.date.isoformat()})"
            )

    is_valid = not (leapday_expiry or weekend_expiry or sensitive_date_matches)

    return {
        "is_valid": is_valid,
        "leapday_expiry": leapday_expiry,
        "weekend_expiry": weekend_expiry,
        "sensitive_date_matches": sensitive_date_matches,
        "warnings": warnings,
    }