x509 certificate as PKCS #12 never valid if notAfter is in the year 2050 or later

[bes]

First of all, thanks for a great project, with good documentation & examples.

I am trying to create a PKCS12 archive from a keypair and a self-signed certificate like so:

forge.rsa.generateKeyPair({bits: 1024, workers: -1}, (err, keypair) => {
        if (err) {
            console.log(err);
            return;
        }
        const privateKey = keypair.privateKey;
        const publicKey = keypair.publicKey;

        const pki = forge.pki;

        const cert = pki.createCertificate();
        cert.publicKey = publicKey;
        cert.serialNumber = '01';
        const attrs = [
            {
                name: 'commonName',
                value: 'x',
            },
            {
                name: 'countryName',
                value: 'x',
            },
            {
                shortName: 'ST',
                value: 'x',
            },
            {
                name: 'localityName',
                value: 'x',
            },
            {
                name: 'organizationName',
                value: 'x',
            },
            {
                shortName: 'OU',
                value: 'x',
            },
        ];
        cert.setSubject(attrs);
        cert.setIssuer(attrs);

        cert.validity.notBefore = new Date();
        cert.validity.notAfter = new Date();
        // Valid for 100 years
        cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 100);
        cert.sign(privateKey);

        const p12 = forge.pkcs12.toPkcs12Asn1(privateKey, cert, 'somePassword', {algorithm: '3des'});
        const p12Der = forge.asn1.toDer(p12).getBytes();
        let p12b64 = forge.util.encode64(p12Der);

        console.log(p12b64);

        // Copy the Base64 and decode as binary into a .p12-file
    });
});

That certificate is not valid since the date is after 2050, and not encoded as a GeneralizedTime as stated in RFC2459

certificate validity dates in 2050 or later MUST be encoded as GeneralizedTime.

Is it possible to create a certificate with GeneralizedTime in some way? Why isn't the date automatically encoded as GeneralizedTime if the date is on or after the year 2050?

Thanks!

[davidlehn]

Thanks for the report. Looks like a bug. Similar issue is handed in some other cases and there are some related PKCS7 and ASN.1 tests. lib/pkcs7.js has the _attributeToAsn1() call that has some code to use the proper output based on the 1950/2050 range from RFC 2985. Looks like RFC 2459 only mentions 2050? I'm guessing the fix will be in lib/x509.js pki.getTBSCertificate(). The notBefore and notAfter dates should be checked for the 2050 limit and create UTCTIME/GENERALIZEDTIME appropriately.

A PR for this would be great (ideally with tests, but looking at pkcs7 tests, that's a bit difficult). Otherwise we'll get to it when we have time.

[davidlehn]

Fixed in PR #636.