Messages in this thread | | | Date | Tue, 25 Sep 2012 17:00:20 +0100 | From | Alan Cox <> | Subject | Re: Wrong system clock vs X.509 date specifiers |
| |
On Tue, 25 Sep 2012 16:35:20 +0100 David Howells <dhowells@redhat.com> wrote:
> Alan Cox <alan@lxorguk.ukuu.org.uk> wrote: > > > Generate a certificate that is valid from a few minutes before the > > wallclock time. It's a certificate policy question not a kernel hackery > > one. > > That doesn't seem to be possible with openssl req. What would you recommend?
LD_PRELOAD ? or fixing it if GNUTLS certtool can't do the needed. We shouldn't botch security checks in kernel code to work around crappy userspace tools.
Alan
| |