0

What will happen if we create rootca X509 certificate with validity date lower than current date? Will date of creation taken into account while cms_verify?

What will happen if we change the system time to a lower date but after the validity start date, why will the cms_verify fail?

    Validity
        Not Before: Apr  4 09:26:00 2016 GMT
        Not After : Apr  4 09:26:00 2026 GMT

faketime -f "2017-01-01 01:00:00" bash -l

date

So 1. Jan 01:00:00 IST 2017

openssl smime -verify -in a.cms -CAfile ./../data/CA.pem -out b.cms.xml

Verification failure

140392937076368:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:pk7_smime.c:342:Verify error:certificate is not yet valid

  • Can you provide details of the testing you've done (especially since the question depends on environment things like modifying system clock). Do you have evidence that cms_verify does fail? – Mike Ounsworth Dec 19 '18 at 15:58
  • 1
    Can you also post the root cert you created? What is its Valid From: field set to? Do you see any other dates in it? – Mike Ounsworth Dec 19 '18 at 16:07
  • @MikeOunsworth used faketime to change date . yes cms_verify fails using openssl smime -verify. – Amruth A Dec 19 '18 at 16:09
  • @MikeOunsworth It had single date 2016 ,set the current date to 2017 it fails.So I was thinking does date of creation matters.? – Amruth A Dec 19 '18 at 16:13
  • The only dates in a cert are the ones ... in the cert. I'm guessing your faketime isn't behaving the way you expect. – Mike Ounsworth Dec 19 '18 at 16:44
3

A certificate has no record of when it was created, just the validity period, represented as a date (and time) for notBefore and notAfter; and either of them can be set to whatever you like (though there's not a well defined behavior of setting notAfter to a value less than notBefore, other than "not working").

  • any other possiblity of cms_verfiy to fail if we change current date to a value below today to notBefore date.If today is the creation of rootca crts. – Amruth A Dec 19 '18 at 17:09
  • 140392937076368:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:pk7_smime.c:342:Verify error:certificate is not yet valid – Amruth A Dec 20 '18 at 8:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.