[openssl-users] Not Before and Not After Date format for openssl API X509_gmtime_adj

2015-07-12 Thread Nayna Jain
Hi all, I am programmatically generating the self signed certificate and need to specify the "Not Before" and "Not After" date, Wanted to understand what all formats are acceptable by this API ? Also, similarly while using API , what exactly is the time format expected by X509_cmp_time(X509_ge

Re: [openssl-users] Not Before and Not After Date format for openssl API X509_gmtime_adj

2015-07-13 Thread Victor Wagner
On Mon, 13 Jul 2015 12:25:40 +0530 Nayna Jain wrote: > > Hi all, > > I am programmatically generating the self signed certificate and need > to specify the "Not Before" and "Not After" date, > > Wanted to understand what all formats are acceptable by this API ? X509_set_notAfter and X509_set_

Re: [openssl-users] Not Before and Not After Date format for openssl API X509_gmtime_adj

2015-07-14 Thread Jakob Bohm
On 13/07/2015 12:22, Victor Wagner wrote: On Mon, 13 Jul 2015 12:25:40 +0530 Nayna Jain wrote: Hi all, I am programmatically generating the self signed certificate and need to specify the "Not Before" and "Not After" date, Wanted to understand what all formats are acceptable by this API ? X

Re: [openssl-users] Not Before and Not After Date format for openssl API X509_gmtime_adj

2015-07-14 Thread Salz, Rich
> This is important when creating root certs with expiry dates after 2038 Not an issue for openssl. As long as you use ASN1_TIME values, it's okay. Might be an issue if converting to time_t on 32-bit platforms. ___ openssl-users mailing list To unsubs

Re: [openssl-users] Not Before and Not After Date format for openssl API X509_gmtime_adj

2015-07-14 Thread Jakob Bohm
On 14/07/2015 21:50, Salz, Rich wrote: This is important when creating root certs with expiry dates after 2038 Not an issue for openssl. As long as you use ASN1_TIME values, it's okay. Might be an issue if converting to time_t on 32-bit platforms. Victor suggested to use only ASN1_TIME_set()

Re: [openssl-users] Not Before and Not After Date format for openssl API X509_gmtime_adj

2015-07-14 Thread Salz, Rich
>if ASN1_TINE_set_string() avoids that limitation, despite Victor's suggestion >to never use it. It does avoid the limitation, using only |struct tm| to hold parsed fields, and not building a |time_t| from it. Not sure why Viktor doesn't like it. It seems to me it's the only portable thing t

Re: [openssl-users] Not Before and Not After Date format for openssl API X509_gmtime_adj

2015-07-15 Thread Victor Wagner
On Tue, 14 Jul 2015 20:35:31 +0200 Jakob Bohm wrote: > > Does ASN1_TIME_set_string() support dates outside the > time_t range of the local libc? Why do yo need time dates outside of 64-bit integer range? Sun would explode into red giant sooner than that amount of time passes. > This is import

Re: [openssl-users] Not Before and Not After Date format for openssl API X509_gmtime_adj

2015-07-15 Thread Jakob Bohm
On 15/07/2015 11:13, Victor Wagner wrote: On Tue, 14 Jul 2015 20:35:31 +0200 Jakob Bohm wrote: Does ASN1_TIME_set_string() support dates outside the time_t range of the local libc? Why do yo need time dates outside of 64-bit integer range? Sun would explode into red giant sooner than that amo

Re: [openssl-users] Not Before and Not After Date format for openssl API X509_gmtime_adj

2015-07-15 Thread Viktor Dukhovni
On Wed, Jul 15, 2015 at 01:33:08AM +, Salz, Rich wrote: > >if ASN1_TINE_set_string() avoids that limitation, despite Victor's > >suggestion to never use it. > > It does avoid the limitation, using only |struct tm| to hold parsed fields, > and not building a |time_t| from it. Not sure why