The validUntil attribute should have a dateTime type set to UTC, which is questionable because python's isoformat() doesn't put the tzinfo, which violates ISO-8601, but I am not here to argue that. For some applications (SimpleSAMLphp) that "validate" the metadata, they kick back the metadata provided by ipsilon because it doesn't have a "Z" at the end of the dateTime. There are a few workarounds mentioned in http://stackoverflow.com/questions/19654578/python-utc-datetime-objects-iso-format-dont-include-z-zulu-or-zero-offset .. but I think the easiest is:

d.isoformat() + 'Z'

Along this same pattern, I am not sure when a "timedelta" would come into play, but datetime.datetime.now() should probably be datetime.datetime.utcnow() to ensure consistency. I know that will only matter on one very special day (certificate expiration day), but its probably better to have it corrected while adding the "Z"

This issue ticket was originally removed from the tracker as it clashed with the pull request.
See upstream ticket for migration details.