390530 - libpkix does not support time override

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P1)

Description

[Alexei Volkov]

old nss code support validity time override for certs that have been validating for certificateUsageSSLServer and certificateUsageSSLServerWithStepUp usages

libpkix does not support this feature.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

IIRC, there is a bit defined in the CERTCertificate that means "the invalid
date for this cert is overridden".  It should be easy to test for that,
at least in the PKIX_PL_ layer.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

P1, we cannot release the CERT_VerifyCert* "wrappers" until this is fixed.

Comment 3

[Alexei Volkov]

The following code should be added into pkix_pl_cert.c:PKIX_PL_Cert_CheckValidity before checking for cert time validity.

allowOverride = (PRBool)((requiredUsages & certificateUsageSSLServer) ||
                        (requiredUsages & certificateUsageSSLServerWithStepUp));
val = CERT_CheckCertValidTimes(cert->nssCert, timeToCheck, allowOverride);

Comment 4

[Alexei Volkov]

Attachment: Patch v1

Allow time override for certificateUsageSSLServer and certificateUsageSSLServerWithStepUp usages

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 312740 [details] [diff] [review]
Patch v1

So simple!  
r=nelson

Comment 6

[Alexei Volkov]

Integrated.