2 ms·
I may not inspect it myself (which wouldn't even catch this issue), but letting it simmer for a week isn't hard.
by tedunangst 3y ago
I may not inspect it myself (which wouldn't even catch this issue), but letting it simmer for a week isn't hard.
- agwa 3y agoThat's a pretty good idea, and would also mitigate clients with slow clocks rejecting a certificate for not being valid yet.
- toast0 3y agoOr clients with poor handling of dates. It's been a while, but Nokia Series 40 was really bad at this. As I recall, it would read the not-before as if the time was specified in local time. So not before noon UTC becomes not before noon wherever you are, so better wait a while for users in the americas.
- schoen 3y agoYeah, we originally were thinking of having separate times for renewal and deployment (e.g. 4 weeks before expiry and 3 weeks before expiry), but there was a countervailing concern that people would think "wait, my certificate has already been renewed but I can't see it on my site!" and get confused or alarmed.