diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 95e6858..900d4ee 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -3773,44 +3773,59 @@ cert_date_to_timestamp_s - safe_set_var - $2 - $timestamp_s"
 	unset -v in_date timestamp_s
 } # => cert_date_to_timestamp_s()
 
-# Convert system date to X509 certificate style date (+)offset
-# TODO minus (-)offset
+# Convert system date plus offset days
+# to X509 certificate style date (+)offset
 offset_days_to_cert_date() {
+	# check input
+	[ "$#" -eq 2 ] || die "\
+offset_days_to_cert_date - input error"
 
-	offset="$1"
+	in_offset="$1"
 
 	# busybox (Alpine)
 	if busybox date --help > /dev/null 2>&1
 	then
-		cert_type_date="$(
+		offset_date="$(
 			busybox date -u -d \
-				"@$(( $(busybox date +%s) + offset * 86400 ))" \
-				"+%b %d %H:%M:%S %Y %Z" 2>/dev/null
-			)"
-		return
+				"@$(( $(busybox date +%s) \
+					+ in_offset * 86400 ))" \
+				"+%b %d %H:%M:%S %Y %Z" \
+				2>/dev/null
+			)" || die "\
+offset_days_to_cert_date - offset_date - busybox"
 
 	# Darwin, BSD
-	elif cert_type_date="$(
-		date -u -j -v "+${offset}d" "+%b %d %H:%M:%S %Y %Z" \
-			2>/dev/null
-		)"
-	then return
+	elif offset_date="$(
+			date -u -j -v "+${in_offset}d" \
+				"+%b %d %H:%M:%S %Y %Z" \
+				2>/dev/null
+			)"
+	then : # ok
 
 	# OS dependencies
-	# Linux and Windows: date.exe does not allow +%s as input
+	# Linux and Windows
+	# date.exe does not allow +%s as input
 	# MacPorts GNU date
-	elif cert_type_date="$(
-		date -u -d "+${offset}days" "+%b %d %H:%M:%S %Y %Z" \
-			2>/dev/null
-		)"
-	then return
+	elif offset_date="$(
+			date -u -d "+${in_offset}days" \
+				"+%b %d %H:%M:%S %Y %Z" \
+				2>/dev/null
+			)"
+	then : # ok
 
 	# Something else
 	else
 		die "\
 offset_days_to_cert_date:
-'date' failed for 'offset': $offset"
+'date' failed for 'in_offset': $in_offset"
 	fi
+
+	# Return offset_date
+	safe_set_var "$2" "$offset_date" || die "\
+offset_days_to_cert_date \
+- safe_set_var - $2 - $offset_date"
+
+	unset -v in_offset offset_date
 } # => offset_days_to_cert_date()
 
 # Convert fixed format date to X509 certificate style date
@@ -4066,13 +4081,17 @@ serial mismatch:
 		"$cert_not_after_date" cert_expire_date_s
 
 	# Set the cutoff date for expiry comparison
-	offset_days_to_cert_date "$EASYRSA_CERT_RENEW" # Assigns cert_type_date
+	cert_type_date=
+	offset_days_to_cert_date \
+		"$EASYRSA_CERT_RENEW" cert_type_date
 	cutoff_date_s=
 	cert_date_to_timestamp_s \
 		"$cert_type_date" cutoff_date_s
 
 	# Set NOW date for expiry comparison
-	offset_days_to_cert_date 0 # Assigns cert_type_date
+	cert_type_date=
+	offset_days_to_cert_date \
+		0 cert_type_date
 	now_date_s=
 	cert_date_to_timestamp_s \
 		"$cert_type_date" now_date_s