actualDuration := certificate.NotAfter.Sub(certificate.NotBefore)
			if isDurationHonored(wantDuration, actualDuration) {
				honored.WithLabelValues(signer).Inc()
			}
		}, nil
	}
}

func isDurationHonored(want, got time.Duration) bool {
	delta := want - got
	if delta < 0 {
		delta = -delta
	}

	// short-lived cert backdating + 5% of want