diff options
| author | Michael Brown <mcb30@ipxe.org> | 2012-06-20 12:15:42 +0100 |
|---|---|---|
| committer | Michael Brown <mcb30@ipxe.org> | 2012-06-20 12:15:42 +0100 |
| commit | 4010890a3940433927f34f71417719167ad58275 (patch) | |
| tree | fbfaf3e01cb49b0cc2bd437fb417998ba6e98346 /src/include/ipxe/x509.h | |
| parent | c0942408b7ab30745952e801381e931b1b947e1f (diff) | |
| download | ipxe-4010890a3940433927f34f71417719167ad58275.tar.gz | |
[crypto] Allow an error margin on X.509 certificate validity periods
iPXE has no concept of the local time zone, mainly because there is no
viable way to obtain time zone information in the absence of local
state. This causes potential problems with newly-issued certificates
and certificates that are about to expire.
Avoid such problems by allowing an error margin of around 12 hours on
certificate validity periods, similar to the error margin already
allowed for OCSP response timestamps.
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/include/ipxe/x509.h')
| -rw-r--r-- | src/include/ipxe/x509.h | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/include/ipxe/x509.h b/src/include/ipxe/x509.h index a5626c8a8..a47942a75 100644 --- a/src/include/ipxe/x509.h +++ b/src/include/ipxe/x509.h @@ -42,6 +42,14 @@ struct x509_validity { struct x509_time not_after; }; +/** Margin of error allowed in X.509 response times + * + * We allow a generous margin of error: 12 hours to allow for the + * local time zone being non-GMT, plus 30 minutes to allow for general + * clock drift. + */ +#define X509_ERROR_MARGIN_TIME ( ( 12 * 60 + 30 ) * 60 ) + /** An X.509 certificate public key */ struct x509_public_key { /** Raw public key information */ |