New answers tagged

33

This is an historically disputed point. In the validation algorithm from RFC 5280 (that supersedes RFC 2459, by the way), there is no requirement of validity range nesting. However, some historical implementations have insisted on it; see for instance the X.509 style guide of Peter Gutmann: Although this isn't specified in any standard, some software ...


14

Hmm, I agree that I would have expected to find this info in RFC 5280 4.1.2.5. Validity. (By the way, RFC 5280 obsoletes RFC 3280, which obsoletes RFC 2459, so you really shouldn't be looking at 2459 any more). That said, you can figure this one out logically (at least for a standard TLS-like setting): When an end-user validates a cert, they have to follow ...



Top 50 recent answers are included