Repository navigation
doc: document invalid X509Certificate validity times - #67406
SarthakAhuja wants to merge 3 commits into
Conversation
When a certificate's notBefore or notAfter time cannot be parsed, validFrom and validTo return the string 'Bad time value', and validFromDate and validToDate return an invalid Date. Relational comparisons with an invalid Date are always false, so a naive expiry check can treat such a certificate as valid. Document the current behavior and tell callers to reject invalid dates first. Signed-off-by: Sarthak Ahuja <39986642+SarthakAhuja@users.noreply.github.com>
|
Review requested:
|
nodejs-github-bot
added
crypto
|
Welcome to Node.js, and thank you for your first contribution! Before review, please take a moment to read:
Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal. |
|
I believe the most important part that's missing is advising to do a positive validity-window check (now >= notBefore && now <= notAfter) so that an invalid bound is rejected, while an out-of-range check (now < notBefore || now > notAfter) could fall victim to this quirk. |
Per review, tell callers to test that the current time is inside the validity window, which rejects an invalid bound, instead of testing whether it is outside the window, which an invalid bound passes. Signed-off-by: Sarthak Ahuja <39986642+SarthakAhuja@users.noreply.github.com>
|
Thanks panva, you're right. Just saying to reject an invalid date is not enough. In both I checked with Node that both checks return |
Apply the review suggestions for validFromDate and validToDate. Signed-off-by: Sarthak Ahuja <39986642+SarthakAhuja@users.noreply.github.com>
panva
added
the
commit-queue-squash
panva
added
author ready
Refs: #67285
panva asked on the issue for this to be documented, because it affects checking a certificate's expiry date: #67285 (comment)
I searched for "Bad time value" and found where it comes from in
deps/ncrypto/ncrypto.cc. I also checked withnode -ethat comparing an invalid Date withDate.now()always givesfalse.I used Claude to help write the documentation wording, run lint, and fix the English in this description.