[tor-bugs] #21420 [Core Tor/Tor]: Link certificate start date in the future

[Tor Bug Tracker & Wiki]

#21420: Link certificate start date in the future
--------------------------+------------------------------------
 Reporter:  mmcloughlin   |          Owner:  nickm
     Type:  defect        |         Status:  needs_review
 Priority:  Medium        |      Milestone:  Tor: 0.3.0.x-final
Component:  Core Tor/Tor  |        Version:
 Severity:  Normal        |     Resolution:
 Keywords:  029-backport  |  Actual Points:
Parent ID:                |         Points:
 Reviewer:                |        Sponsor:
--------------------------+------------------------------------
Changes (by nickm):

 * status:  assigned => needs_review
 * keywords:   => 029-backport


Comment:

 Hm.  It looks like we started using that approach in 0196647970a91d, but
 I'm not at all sure that's right.  I think we wanted to do something like
 choosing a start time at the start of a day, between this most recent
 midnight, and up to cert_lifetime in the past, but making sure that we
 don't wind up with an expiration time in the past.

 My branch `bug21420_029` in my public git repository [1] tries to fix
 this.  I've marked it as a possible backport to 0.2.9, but I believe it's
 safe to leave this as-is in existing tors, since
 check_cert_lifetime_internal() is called with a 30-day future tolerance.

 [1]
 https://gitweb.torproject.org/nickm/tor.git/commit/?h=bug21420_029&id=d839f798a5812fc81fcc5b4b06604ed08dc2e558
 for the HTML version;
 https://git.torproject.org/nickm/tor.git for the repository itself.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/21420#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online