As reported by @mehmetakbulut on #24084:

Is your feature request related to a problem? Please describe. It is not possible to set validity window start to a specific value currently. This is because not_before_duration field accepts a duration to be set at configuration-time.

Describe the solution you'd like not_before field should be added to accept an absolute timestamp.

Describe alternatives you've considered

1. Add toggle to disable validity window. This would work for some use-cases but not for all.

2. Use special or large value to make `not_before_duration` work. This does not work currently because of underflow.

Explain any additional use-cases

1. Many air-gapped system without GPS and/or RTC bootup with their clocks set to Unix epoch. These cannot accept a validity window starting at `utc_now - not_before_duration`.

2. Certificates could be generated ahead-of-time for key rotation or other similar exercise with a future `not_before` date and remain invalid until rotation occurs.

Additional context See #13608

This sounds like a good improvement and helps bring parity with PKI's implementation.