search

cchandler / certificate_authority

Ruby gem for managing the core functions outlined in RFC-3280 for PKI
https://github.com/cchandler/certificate_authority
194 stars 44 forks source link

Add last_update time offset option to crls #38

Closed databus23 closed 9 years ago

databus23 commented 10 years ago

Using Time.now for the last_update field of the crls is problematic when validating clients clocks are out of sync. At least openssl refuses to validate a certificate when crl checking is enabled and the locally cached crl is not yet valid. Therefore it is common practice to generate crls with a last_update timestamp that is slightly in the past.

cchandler commented 9 years ago

Hey-o. Finally going through my old emails. Seems reasonable :-)