Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed clock skew problems with dynamically created certificates #2019

Merged
merged 1 commit into from
Mar 14, 2023

Conversation

DrMetallius
Copy link
Contributor

There is an issue when using dynamically generated certificates for TLS connections to Wiremock regarding the certificate validity start time. The certificates are generated with validity start time being the same instant as the request arrives. If Wiremock runs at the same machine as the client, the problem doesn't manifest itself as they are both using the same clock. However, if the client is somewhere else and its time lags behind the Wiremock machine's time, even if it's an infinitesimal difference, the certificates won't be marked as valid.

To fix the clock skew problem, the certificates are now generated using a day before the present moment as the start time. This avoids the problem.

@tomakehurst
Copy link
Member

@Mahoney WDYT?

Copy link
Collaborator

@Mahoney Mahoney left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems reasonable; I did some research, there doesn't seem to be anything intrinsically dangerous about setting validity to the past.

@tomakehurst tomakehurst merged commit 6df0e8a into wiremock:master Mar 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants