NotBefore and NotAfter are not supported

[Osiris]

I’m assuming this is the phase you’re sending the CSR to the ACME server, correct?

Let’s Encrypt sets the time and dates of those values, it’s not possible for the client to set them in the final certificate. I was under the assumption the ACME server just ignored those values from the CSR, but perhaps the ACME v2 server doesn’t allow them.

Further reading:

• V02 staging accepts bogus “notAfter”
• Boulder WFEv2 should reject unfulfillable notAfter and notBefore #3363
  
• Reject NotBefore and NotAfter if sent in NewOrder Request #3397