Hi, On Sun, Mar 09, 2014 at 03:29:31PM +0100, Michael Post wrote: > openssl verify -CAfile ca_cert.pem -verbose > clients/client-cert-MichaelPost.pem says that my client certificate is > also expired. > > Any clue?
*that* is going to be much more awful to fix.
You might get away with setting the clock on the server back a month or
so ("still in the validity period") and then replace all certs of
incoming clients, using the *new* server side cert (so clients with a
correct time see something that is valid for them).
I'm not fully sure whether that hack works, though, or whether there
is a timestamp in the SSL handshake.
When I had to do that, I was lucky in that the client had a OpenWRT based
device that lost it's time upon powercycle anyway, and came up a few
month earlier...
gert
--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]
fax: +49-89-35655025 [email protected]
pgpbx0nb09JCQ.pgp
Description: PGP signature
------------------------------------------------------------------------------ Subversion Kills Productivity. Get off Subversion & Make the Move to Perforce. With Perforce, you get hassle-free workflows. Merge that actually works. Faster operations. Version large binaries. Built-in WAN optimization and the freedom to use Git, Perforce or both. Make the move to Perforce. http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk
_______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
