micromdm / scep

Go SCEP server
MIT License
310 stars 121 forks source link

Increase Signer grace from 600ns to 10 minutes #193

Closed mceIdo closed 2 years ago

mceIdo commented 2 years ago

Got an error in some enrollment cases, where the device's time was slightly off of the server's time (about 10 seconds) It seems like when issuing a certificate, it was intentionally subtracting time in the NotBefore field for to allow these minor discrepancies. The problem is that it was adding -600 nanoseconds which is not nearly enough for such cases, and I think was a mistake as it seems the intention was to add -600 seconds Hope I'm right :)