From 4010890a3940433927f34f71417719167ad58275 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Wed, 20 Jun 2012 12:15:42 +0100 Subject: [crypto] Allow an error margin on X.509 certificate validity periods iPXE has no concept of the local time zone, mainly because there is no viable way to obtain time zone information in the absence of local state. This causes potential problems with newly-issued certificates and certificates that are about to expire. Avoid such problems by allowing an error margin of around 12 hours on certificate validity periods, similar to the error margin already allowed for OCSP response timestamps. Signed-off-by: Michael Brown --- src/crypto/ocsp.c | 4 ++-- src/crypto/x509.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) (limited to 'src/crypto') diff --git a/src/crypto/ocsp.c b/src/crypto/ocsp.c index f5d03dc68..ab75dea35 100644 --- a/src/crypto/ocsp.c +++ b/src/crypto/ocsp.c @@ -794,12 +794,12 @@ int ocsp_validate ( struct ocsp_check *ocsp, time_t time ) { /* Check OCSP response is valid at the specified time * (allowing for some margin of error). */ - if ( response->this_update > ( time + OCSP_ERROR_MARGIN_TIME ) ) { + if ( response->this_update > ( time + X509_ERROR_MARGIN_TIME ) ) { DBGC ( ocsp, "OCSP %p \"%s\" response is not yet valid (at " "time %lld)\n", ocsp, ocsp->cert->subject.name, time ); return -EACCES_STALE; } - if ( response->next_update < ( time - OCSP_ERROR_MARGIN_TIME ) ) { + if ( response->next_update < ( time - X509_ERROR_MARGIN_TIME ) ) { DBGC ( ocsp, "OCSP %p \"%s\" response is stale (at time " "%lld)\n", ocsp, ocsp->cert->subject.name, time ); return -EACCES_STALE; diff --git a/src/crypto/x509.c b/src/crypto/x509.c index 1a27eb24c..a99f6ab93 100644 --- a/src/crypto/x509.c +++ b/src/crypto/x509.c @@ -1264,12 +1264,12 @@ int x509_check_time ( struct x509_certificate *cert, time_t time ) { struct x509_validity *validity = &cert->validity; /* Check validity period */ - if ( time < validity->not_before.time ) { + if ( validity->not_before.time > ( time + X509_ERROR_MARGIN_TIME ) ) { DBGC ( cert, "X509 %p \"%s\" is not yet valid (at time %lld)\n", cert, cert->subject.name, time ); return -EACCES_EXPIRED; } - if ( time > validity->not_after.time ) { + if ( validity->not_after.time < ( time - X509_ERROR_MARGIN_TIME ) ) { DBGC ( cert, "X509 %p \"%s\" has expired (at time %lld)\n", cert, cert->subject.name, time ); return -EACCES_EXPIRED; -- cgit v1.2.3-55-g7522