diff --git a/src/client.rs b/src/client.rs
index f6d25c0..16b9ff3 100644
--- a/src/client.rs
+++ b/src/client.rs
@@ -7,7 +7,7 @@ use std::io::{stdin, stdout};
 use std::path::PathBuf;
 use std::time::{Duration, SystemTime};
 use tokio::fs;
-use tracing::{debug, error, info, instrument};
+use tracing::{debug, error, info, instrument, trace};
 
 use url::Url;
 
@@ -119,13 +119,15 @@ async fn fetch(
     let certs = read_dir(&cert_dir).await?;
     let client = reqwest::Client::new();
     let threshold_exp = min_delta.and_then(|min_delta| {
-        SystemTime::now().checked_sub(Duration::from_secs(60 * 60 * 24 * min_delta as u64))
+        SystemTime::now().checked_add(Duration::from_secs(60 * 60 * 24 * min_delta as u64))
     });
     let updates = certs
         .into_iter()
         .filter(|cert| {
             let exp = cert.valid_before_time();
-            threshold_exp.as_ref().map(|th| &exp < th).unwrap_or(true)
+            let must_check = threshold_exp.as_ref().map(|th| &exp < th);
+            trace!(?cert, ?must_check, "filter");
+            must_check.unwrap_or(true)
         })
         .map(|cert| {
             let path = GetCert {