certificate verify fails in 2020-01-01

[bmwiedemann]

For reproducible builds we need to test if software builds still produce the same result when building it later. However, for pyOpenSSL this is currently not possible, because parts of the testsuite fail with

Error: [('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')]

failing tests are
TestX509StoreContext.test_valid
TestX509StoreContext.test_reuse
TestX509StoreContext.test_modification_pre_verify
TestContext.test_add_extra_chain_cert
TestContext.test_use_certificate_chain_file_bytes
TestContext.test_use_certificate_chain_file_unicode

Also, independently of that, as a Linux distribution, we want to be able to ship updated versions of packages with added patches (even when upstream support expired) for up to 15 years.

possible approaches:

• generate CA and other certs on demand so they will be valid at the time of test
• check the current time and expect those tests to fail
• check the current time and skip those tests

[daa]

Also it's possible to set time parameter of X509 store and context to use it to verify certificate instead of current time.

[bmwiedemann]

TestContext.test_add_extra_chain_cert is already failing in 2020-01-01 (still works 2019-12-31)

I am testing with python-pyOpenSSL-18.0.0 on openSUSE Tumbleweed.

[bmwiedemann]

same problem with 19.0.0

[reaperhulk]

We would accept a patch to fix this.

[bmwiedemann]

@alex fixed it in 675534c for #888