3 ms·
"It's true that RFC3280 says that the GeneralizedTime format must be used only for dates beginning in 2050. This is to allow compatibility with existing implem
by throwawaaarrgh 5y ago
"It's true that RFC3280 says that the GeneralizedTime format must be used only for dates beginning in 2050. This is to allow compatibility with existing implementations (like NSS) that do not yet support the format. However, there is no reason for an implementation that supports GeneralizedTime to reject a certificate (or other object) that contains dates before 2050 that are encoded using that format. Dates generated by NSS should use the RFC guideline to ensure interoperability with other RFC3280-conformant implementations." - https://bugzilla.mozilla.org/show_bug.cgi?id=143334 https://bugzilla.mozilla.org/show_bug.cgi?id=143334 (2002)
"In the past, Firefox was lenient, NSS still is lenient, but mozilla::pkix is strict. I found a comment in the mozilla::pkix which says the alternative encodings from asn.1 explicitly aren't allowed." - https://bugzilla.mozilla.org/show_bug.cgi?id=1152515 https://bugzilla.mozilla.org/show_bug.cgi?id=1152515 (2015)
An interesting comment in there also mentions how QA testing just one function with different dates might require changing the system date, but that would test more than just the one function... I wonder how many pieces of software might miss bugs due to complex tests like this.