Jira (PUP-2636) CRL last_update should be valid more than 1 second in the past

[Joshua Cooper (JIRA)]

Title: Message Title

Joshua Cooper created an issue   Puppet / PUP-2636 CRL last_update should be valid more than 1 second in the past Issue Type: Bug Assignee: Andy Parker Components: Networking Services Created: 22/May/14 10:03 AM Priority: Normal Reporter: Joshua Cooper When puppet's CA generates a CRL, it sets the last_update field to one second in the past (relative to the CA's local time). https://github.com/puppetlabs/puppet/blob/3.6.0/lib/puppet/ssl/certificate_revocation_list.rb#L87 When the CRL is downloaded to the agent, the agent will use it when making authenticated SSL connections. If the agent's local time, is slightly in the past, then the CRL will not yet be valid, and cause errors like: Error: Could not request certificate: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [CRL is not yet valid for /CN=o85sgww6moc2jxb.delivery.puppetlabs.net] We should set the CRL last_update time earlier in the past to be less sensitive to timing issues. In the case of Certificates, we set the not_before time to 24 hours in the past: https://github.com/puppetlabs/puppet/blob/3.6.0/lib/puppet/ssl/certificate_factory.rb#L49 Add Comment   This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.