Re: SSL cert chain validation & timestamp issues

2010-12-21 Thread David Schwartz
On 12/20/2010 10:49 AM, travis+ml-open...@subspacefield.org wrote: So a friend ran into this lately; libnss, at least on Linux, checks that the signing cert (chain) is valid at the time of signature - as opposed to present time. (It may check present time as well - not sure on that) This is

Re: SSL cert chain validation & timestamp issues

2010-12-20 Thread Victor Duchovni
On Mon, Dec 20, 2010 at 10:49:57AM -0800, travis+ml-open...@subspacefield.org wrote: > libnss, at least on Linux, checks that the signing cert (chain) is valid > at the time of signature - as opposed to present time. (It may check > present time as well - not sure on that) > > This makes for pr

SSL cert chain validation & timestamp issues

2010-12-20 Thread travis+ml-openssl
So a friend ran into this lately; libnss, at least on Linux, checks that the signing cert (chain) is valid at the time of signature - as opposed to present time. (It may check present time as well - not sure on that) This makes for problems if you renew the cert, since the new cert will have a c