SensitiveDate Validator

Flags certificates that expire on a date you'd rather not be doing an emergency renewal: weekends, leap days, or your own list of blackout dates (holidays, change freezes, peak-traffic events). A proactive scheduling check rather than a security one.

Opt-in

Enable via enabled_validators=["sensitive_date", ...] or ENABLED_VALIDATORS. Weekend and leap-day checks run automatically; pass dates to add your own.

Try it

from certmonitor import CertMonitor

with CertMonitor("example.com", enabled_validators=["sensitive_date"]) as monitor:
    monitor.get_cert_info()
    result = monitor.validate(
        validator_args={"sensitive_date": {"dates": ["2025-12-25", ["Black Friday", "2025-11-28"]]}}
    )
    print(result["sensitive_date"])

A certificate expiring on a weekend (built-in check) fails:

These examples show selected fields from illustrative scans. validate() also adds status and code, described in the result contract.

{
  "is_valid": false,
  "leapday_expiry": false,
  "weekend_expiry": true,
  "sensitive_date_matches": [],
  "warnings": ["Certificate expires on a weekend (Saturday)"],
  "reason": "Certificate expires on a sensitive date: Certificate expires on a weekend (Saturday)"
}

Arguments

Pass via validator_args={"sensitive_date": {...}}:

Argument	Type	Default	Description
dates	List[...]	None	Extra dates to flag. Each entry may be an ISO string ("2025-12-25"), a date/datetime, a (name, date) tuple, or a SensitiveDate.

The accepted entry shapes:

Form	Example
ISO date string	"2025-12-25"
(name, date) tuple	("Black Friday", "2025-11-28")
datetime.date	date(2025, 12, 25)

Reading the result

Field	Meaning
weekend_expiry	Certificate expires on a Saturday or Sunday.
leapday_expiry	Certificate expires on February 29.
sensitive_date_matches	Your supplied dates that matched, each with name and date.
is_valid	false if any of the above fired.

It's about when, not whether

A false here doesn't mean the certificate is insecure. It means the expiry lands somewhere inconvenient. Use it to nudge renewals onto a business day well ahead of a freeze.

Reference

certmonitor.validators.sensitive_date.SensitiveDateValidator

Bases: BaseCertValidator

A validator for checking if an SSL certificate expires on a sensitive/special date.

Attributes:

Name	Type	Description
name	str	The name of the validator.

name class-attribute instance-attribute

name = 'sensitive_date'

validate

validate(cert: dict[str, Any], host: str, port: int, *, dates: list[SensitiveDateInput] | None = None) -> SensitiveDateResult

Validates the sensitivity of the expiry date of the provided SSL certificate.

Parameters:

Name	Type	Description	Default
cert	dict	The SSL certificate.	required
host	str	The hostname (not used in this validator).	required
port	int	The port number (not used in this validator).	required
dates	list	Sensitive dates to match against the certificate's expiration date. Each entry may be a SensitiveDate, a plain date / datetime, an ISO date string ("2025-12-25"), or a (name, date) tuple. Defaults to None (no sensitive-date matching; weekend and leap-day checks still run).	None

Returns:

Name	Type	Description
dict	SensitiveDateResult	A dictionary containing: is_valid (bool): True iff none of the checks fired. leapday_expiry (bool): certificate expires on Feb 29. weekend_expiry (bool): certificate expires on Saturday/Sunday. sensitive_date_matches (list): structured records of any user-supplied dates that matched, each with name and date (ISO 8601 string). warnings (list of str): human-readable summary lines for every condition that fired.

Examples:

Example output (success):

```json
{
    "is_valid": true,
    "leapday_expiry": false,
    "weekend_expiry": false,
    "sensitive_date_matches": [],
    "warnings": []
}
```

Example output (failure):

```json
{
    "is_valid": false,
    "leapday_expiry": false,
    "weekend_expiry": true,
    "sensitive_date_matches": [
        {"name": "Busy Sunday", "date": "2025-11-16"}
    ],
    "warnings": [
        "Certificate expires on a weekend (Sunday)",
        "Certificate is due to expire on sensitive date \"Busy Sunday\" (2025-11-16)"
    ],
    "reason": "Certificate expires on a sensitive date: Certificate expires on a weekend (Sunday); Certificate is due to expire on sensitive date \"Busy Sunday\" (2025-11-16)"
}
```

Source code in certmonitor/validators/sensitive_date.py

def validate(
    self,
    cert: dict[str, Any],
    host: str,
    port: int,
    *,
    dates: list[SensitiveDateInput] | None = None,
) -> SensitiveDateResult:
    """
    Validates the sensitivity of the expiry date of the provided SSL certificate.

    Args:
        cert (dict): The SSL certificate.
        host (str): The hostname (not used in this validator).
        port (int): The port number (not used in this validator).
        dates (list, optional): Sensitive dates to match against the
            certificate's expiration date. Each entry may be a
            `SensitiveDate`, a plain `date` / `datetime`, an ISO date
            string (`"2025-12-25"`), or a `(name, date)` tuple.
            Defaults to `None` (no sensitive-date matching; weekend and
            leap-day checks still run).

    Returns:
        dict: A dictionary containing:

            - `is_valid` (bool): `True` iff none of the checks fired.
            - `leapday_expiry` (bool): certificate expires on Feb 29.
            - `weekend_expiry` (bool): certificate expires on Saturday/Sunday.
            - `sensitive_date_matches` (list): structured records of any
              user-supplied dates that matched, each with `name` and
              `date` (ISO 8601 string).
            - `warnings` (list of str): human-readable summary lines for
              every condition that fired.

    Examples:
        Example output (success):

            ```json
            {
                "is_valid": true,
                "leapday_expiry": false,
                "weekend_expiry": false,
                "sensitive_date_matches": [],
                "warnings": []
            }
            ```

        Example output (failure):

            ```json
            {
                "is_valid": false,
                "leapday_expiry": false,
                "weekend_expiry": true,
                "sensitive_date_matches": [
                    {"name": "Busy Sunday", "date": "2025-11-16"}
                ],
                "warnings": [
                    "Certificate expires on a weekend (Sunday)",
                    "Certificate is due to expire on sensitive date \\"Busy Sunday\\" (2025-11-16)"
                ],
                "reason": "Certificate expires on a sensitive date: Certificate expires on a weekend (Sunday); Certificate is due to expire on sensitive date \\"Busy Sunday\\" (2025-11-16)"
            }
            ```
    """
    normalized: list[SensitiveDate] = []
    if dates:
        for item in dates:
            try:
                normalized.append(_normalize(item))
            except (TypeError, ValueError) as exc:
                invalid: SensitiveDateResult = {
                    "is_valid": False,
                    "reason": f"Invalid sensitive date input: {exc}",
                    "leapday_expiry": False,
                    "weekend_expiry": False,
                    "sensitive_date_matches": [],
                    "warnings": [],
                }
                return invalid

    not_after = parse_not_after(cert)
    expiry_date = not_after.date()
    weekday = not_after.weekday()

    leapday_expiry = expiry_date.month == 2 and expiry_date.day == 29
    weekend_expiry = weekday in (5, 6)

    warnings: list[str] = []
    if leapday_expiry:
        warnings.append(
            f"Certificate expires on a leap day ({expiry_date.isoformat()})"
        )
    if weekend_expiry:
        day_name = "Saturday" if weekday == 5 else "Sunday"
        warnings.append(f"Certificate expires on a weekend ({day_name})")

    sensitive_date_matches: list[dict[str, str]] = []
    for sd in normalized:
        if expiry_date == sd.date:
            sensitive_date_matches.append(
                {"name": sd.name, "date": sd.date.isoformat()}
            )
            warnings.append(
                f'Certificate is due to expire on sensitive date "{sd.name}"'
                f" ({sd.date.isoformat()})"
            )

    is_valid = not (leapday_expiry or weekend_expiry or sensitive_date_matches)

    result: SensitiveDateResult = {
        "is_valid": is_valid,
        "leapday_expiry": leapday_expiry,
        "weekend_expiry": weekend_expiry,
        "sensitive_date_matches": sensitive_date_matches,
        "warnings": warnings,
    }
    if not is_valid:
        result["reason"] = "Certificate expires on a sensitive date: " + "; ".join(
            warnings
        )
    return result