Which of these options are actually in line with standards?
In software that generates SSL client certificates to hand out to client software for authentication into a closed system, should the
NotBefore field be set to the time of generation, or that time subtracted by some leeway?
The main points of concern here are:
- Clock-skew between the generating server and the authenticating server.
- Clock-skew on the client OS.
- Any vulnerabilities that arise from going too permissive on the
The options are:
- Include the leeway in the
- Don't add leeway to the
NotBeforedate but instead cater for it during validation. (At a glance, this doesn't appear to be a common option, so likely involves hacking low-level SSL implementation on server software.)
- Don't add leeway and handle clock-skew directly on the servers. (This doesn't handle the client, but a small sample of APIs I looked at (namely .NET Framework) don't seem to mind choosing yet-to-be-valid certificates.)