alter has_expired to fix bugs related to ASN1_UTCTIME_cmp_time_t
RFC 5280 states that UTCTime must be used for validity dates through
2049 and GeneralizedTime must be used for 2050 or later. To be safe, we
get the string form of the date using get_notAfter, which eventually
calls _get_asn1_time. This function converts an ASN1_TIME to
GeneralizedTime, so we have a UTC time string of the form
%Y%m%d%H%M%SZ. Finally, we convert that to a timestamp and then compare
it against the current UTC time to see if it has expired.
1 file changed