diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index b14c4876884..fadaa4d200d 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -3517,6 +3517,9 @@ added: v15.6.0
 
 The date/time from which this certificate is valid.
 
+If the certificate's `notBefore` time cannot be parsed, this is the string
+`'Bad time value'`.
+
 ### `x509.validFromDate`
 
 <!-- YAML
@@ -3529,6 +3532,16 @@ added:
 
 The date/time from which this certificate is valid, encapsulated in a `Date` object.
 
+If the certificate's `notBefore` time cannot be parsed, this property is an
+invalid `Date` whose `getTime()` method returns `NaN`.
+
+Relational comparisons with an invalid `Date` evaluate to `false`. To check
+whether the current time is within the certificate's validity period, use
+`now >= x509.validFromDate && now <= x509.validToDate`. This expression
+evaluates to `false` if either date is invalid. Checking
+`now < x509.validFromDate || now > x509.validToDate` instead can fail to
+reject certificates with invalid dates.
+
 ### `x509.validTo`
 
 <!-- YAML
@@ -3539,6 +3552,9 @@ added: v15.6.0
 
 The date/time until which this certificate is valid.
 
+If the certificate's `notAfter` time cannot be parsed, this is the string
+`'Bad time value'`.
+
 ### `x509.validToDate`
 
 <!-- YAML
@@ -3551,6 +3567,16 @@ added:
 
 The date/time until which this certificate is valid, encapsulated in a `Date` object.
 
+If the certificate's `notAfter` time cannot be parsed, this property is an
+invalid `Date` whose `getTime()` method returns `NaN`.
+
+Relational comparisons with an invalid `Date` evaluate to `false`. To check
+whether the current time is within the certificate's validity period, use
+`now >= x509.validFromDate && now <= x509.validToDate`. This expression
+evaluates to `false` if either date is invalid. Checking
+`now < x509.validFromDate || now > x509.validToDate` instead can fail to
+reject certificates with invalid dates.
+
 ### `x509.signature`
 
 <!-- YAML