diff options
| author | Paul Kehrer <paul.l.kehrer@gmail.com> | 2019-01-21 22:36:25 -0600 |
|---|---|---|
| committer | Alex Gaynor <alex.gaynor@gmail.com> | 2019-01-21 23:36:25 -0500 |
| commit | 767fa8511caade795457b23ea9d3d85af1ed12bb (patch) | |
| tree | 917394e703ca72b35c82b2c9b06e1db22c0363a5 /src/_cffi_src/openssl | |
| parent | 5b3e735253d4cc1c7f51dedc11c9ca5eeb6f451f (diff) | |
| download | cryptography-767fa8511caade795457b23ea9d3d85af1ed12bb.tar.gz cryptography-767fa8511caade795457b23ea9d3d85af1ed12bb.tar.bz2 cryptography-767fa8511caade795457b23ea9d3d85af1ed12bb.zip | |
allow 32-bit platforms to encode certs with dates > unix epoch (#4727)
Previously we used unix timestamps, but now we are switching to using
ASN1_TIME_set_string and automatically formatting the string based on
the year. The rule is as follows:
Per RFC 5280 (section 4.1.2.5.), the valid input time
strings should be encoded with the following rules:
1. UTC: YYMMDDHHMMSSZ, if YY < 50 (20YY) --> UTC: YYMMDDHHMMSSZ
2. UTC: YYMMDDHHMMSSZ, if YY >= 50 (19YY) --> UTC: YYMMDDHHMMSSZ
3. G'd: YYYYMMDDHHMMSSZ, if YYYY >= 2050 --> G'd: YYYYMMDDHHMMSSZ
4. G'd: YYYYMMDDHHMMSSZ, if YYYY < 2050 --> UTC: YYMMDDHHMMSSZ
Notably, Dates < 1950 are not valid UTCTime. At the moment we still
reject dates < Jan 1, 1970 in all cases but a followup PR can fix
that.
Diffstat (limited to 'src/_cffi_src/openssl')
0 files changed, 0 insertions, 0 deletions