Repository: go
Issue: cmd/go, crypto/x509: go mod tidy reports certificate expired on a non-expired certificate
Labels: NeedsInvestigation

<!--
Please answer these questions before submitting your issue. Thanks!
-->

### What version of Go are you using (`go version`)?

<pre>
$ go version
go version go1.20.5 linux/amd64
</pre>

### Does this issue reproduce with the latest release?

Yes

### What operating system and processor architecture are you using (`go env`)?

<details><summary><code>go env</code> Output</summary><br><pre>
$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/yorick/.cache/go-build"
GOENV="/home/yorick/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/yorick/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/yorick/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20.5"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/yorick/Development/dss/udptogrpc/go.mod"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1398362822=/tmp/go-build -gno-record-gcc-switches"
</pre></details>

### What did you do?

<!--
If possible, provide a recipe for reproducing the error.
A complete runnable program is good.
A link on go.dev/play is best.
-->

When running `go mod tidy` with an import from a local GitLab instance with a non-expired certificate it is reported as expired.

```go
package main

import (
	"localgitlabinstance/package"
)

func main() {
	package.Function()
}
```
The snippet above illustrates the basic setup used. When running `go mod tidy` it returns the following output:

<details><summary><code>go mod tidy</code> Output</summary><br><pre>
server response: not found: localgitlabinstance/package@v0.0.0-20230606093113-3ea3ca83ba60: unrecognized import path "localgitlabinstance/package": https fetch: Get "localgitlabinstance/package?go-get=1": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2023-06-07T08:48:08Z is after 2013-07-26T11:03:57Z
</pre></details>

When checking the certificate via Chrome and by using `echo | openssl s_client -showcerts -servername localgitlabinstance -connect localgitlabinstance:443 2>/dev/null | openssl x509 -inform pem -noout -text` the certificate is valid from:
```
Validity
  Not Before: Jan 16 00:00:00 2023 GMT
  Not After : Jan 18 23:59:59 2024 GMT
```

When changing my system time to before `2013-07-26T11:03:57Z` I get the following output:
<details><summary><code>go mod tidy</code> Output</summary><br><pre>
localgitlabinstance/package: cannot find module providing package localgitlabinstance/package: unrecognized import path "localgitlabinstance/package": https fetch: Get "localgitlabinstance/package?go-get=1": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2013-06-01T00:01:16+02:00 is before 2023-01-16T00:00:00Z
</pre></details>

It then successfully retrieves the `Not Before` timestamp. 

The path taken from retrieving the certificate retrieval in the TLS handshake to verifying it seems pretty clear, so I'm uncertain where this discrepancy between the `crypto/x509` parsing and the other tooling comes from.