I am investigating the possibility of testing a system which relies on SSL/TLS with a client which, for testing purposes only, has a very different clock time, at least several weeks different from the actual time.

I am aware that if the client's clock is very different from the server, the server might reject the client. Is there any configurable parameter in SSL/TLS which allows the server's acceptable client clock skew to be specified? If so, what is the maximum value of the acceptable clock skew?

A little context. I am working on a software application which is supposed to run for a period of weeks or months. For testing purposes, it would be convenient to start testing at a certain time, and then fast forward through the following weeks and months by changing the client's system clock.

  • 1
    I believe the client doesn't send its clock time to the server, only the other way around. And even that is gone as of TLS 1.3. Clock skew is only a problem if it messes with certificate expiry. – forest Aug 16 '19 at 0:40
  • Thanks for the insight. I am guessing that changing the time range on the certificate is out of reach of the server admin, since the certificate is issued by someone else and presumably any modification isn't allowed. So that suggests that the maximum client clock skew is derived from the certificate, which cannot be changed. Does that seem correct? – Robert Dodier Aug 16 '19 at 0:44
  • Right. The clock skew for the client isn't given to the server. It's only a problem if the client thinks it's so far in the future or past that a certificate's expiration date is out of range. – forest Aug 16 '19 at 0:45
  • @forest+ through TLS 1.2 (and in SSL) the first 4 bytes of the 'random' (nonce) in both ClientHello and ServerHello is supposed to be a Unix-style timestamp (seconds since 1970-01-01), but I don't know anyone that checks it. This spec is gone in 1.3, and although not listed in the rev history I believe it was removed because it was agreed to be useless. That said, it seems to me a better simulation of running for a long time would be to DeLorean the clocks at both ends -- you can just use a VM and discard it afterwards. – dave_thompson_085 Aug 16 '19 at 1:03
  • @dave_thompson_085 Even from the client? I was under the impression that it was randomized. – forest Aug 16 '19 at 1:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.