This carries the expiration, valid-to, date of the certificate referenced in a security notification. This is the single most actionable piece of data in a certificate-expiry trap, since it tells the admin exactly how much runway remains, or has already passed, to renew and reinstall the certificate before it lapses and potentially breaks TLS or SSH connectivity that depends on it. For example, a notification carrying this as 2026-09-15 for a device certificate expiring in about a month gives the admin a concrete deadline to schedule the certificate renewal.