2 ms·
Something the author didn't note is that RFC 5280 requires that times before 2050 are encoded as UTCTime and not GeneralizedTime. That also contributes to softw
by Arnavion 5y ago
Something the author didn't note is that RFC 5280 requires that times before 2050 are encoded as UTCTime and not GeneralizedTime. That also contributes to software being written to only parse UTCTime and not GeneralizedTime, because most extant certs as of today expire before 2050. The longest-lived CA cert in my Linux distro expires in 2046.
- tialaramex 5y agoAlso, for the root trust store it's reasonable to just ignore the notBefore/ notAfter values so you won't need to parse 2050 dates until other certificates need them. If you don't trust this root any more, remove it from your trust store, and if you don't trust it yet, it won't be in the store. This is a contrast to intermediate and leaf certificates which you are shown by other parties and so will need that notBefore/ notAfter information to make trust decisions. This is why Let's Encrypt expects to still work for people on old Android phones that haven't seen a software update in many years, even after the root via which those phones trust Let's Encrypt "expires" later in 2021. Android doesn't check the expiry date on roots and these phones aren't getting updates so they won't be updated to stop trusting the obsolete root.