Subject: Re: [pkix] Advice on (small amounts of) clock skew?

From: Peter Gutmann <[email-masked]>
Date: Fri, 21 Dec 2012 04:10:42 +0000

Martin Rex <[email-masked]> writes:

>When I first implemented code to create certs (and later also to sign/issue),
>I decided to create certs with notBefore 24h into the past from current time,
>so that I will _never_ encounter problems with clock skew about notBefore, no
>matter how the code that validates it is actually implemented.

My code does that too.  Another vendor calls it "the 86400 kludge", because
they always subtract 86400 seconds from the issue time to avoid problems like
this.

Peter.

---

From: Yoav Nir <[email-masked]>
Date: Fri, 21 Dec 2012 05:06:00 +0000

> they always subtract 86400 seconds from the issue time to avoid problems like

24h gets you around people who have their clock set correctly to local time, but have the wrong time zone, so the UTC time is really wrong. You don't see it much on PCs these days, but it's still common on servers.

Yoav