I had HubN issue a certificate and immediately hand it to a client. The dates were right, the signature was right, and the client rejected it as not yet valid.
The CA and the machine using the certificate disagreed about the time by a few seconds. That was enough. A certificate whose notBefore is exactly the moment it was issued assumes every clock involved agrees exactly, which is optimistic even on a small private network.
HubN now sets notBefore slightly in the past. It does not make the certificate live meaningfully earlier, but it gives normal clock skew somewhere harmless to go.
It is a tiny allowance, and one I used to dislike on principle. In practice, the supposedly more precise version was just brittle. Time is an input from another system too.