Re-add default NotBefore duration in PKI (#5482)

Fixes #5481

Re-add default NotBefore duration in PKI (#5482)
Fixes #5481
1200c98b · Jeff Mitchell · GitHub · 2b713c75 · 1200c98b
Unverified Commit 1200c98b authored 6 years ago by Jeff Mitchell Committed by GitHub 6 years ago
Hide whitespace changes
Inline Side-by-side

Showing

with 2 additions and 0 deletions
+2 -0
--- a/builtin/logical/pki/cert_util.go
+++ b/builtin/logical/pki/cert_util.go
@@ -1178,6 +1178,7 @@ func createCertificate(data *dataBundle) (*certutil.ParsedCertBundle, error) {

 	certTemplate := &x509.Certificate{
 		SerialNumber:   serialNumber,
+		NotBefore:      time.Now().Add(-30 * time.Second),
 		NotAfter:       data.params.NotAfter,
 		IsCA:           false,
 		SubjectKeyId:   subjKeyID,
@@ -1380,6 +1381,7 @@ func signCertificate(data *dataBundle) (*certutil.ParsedCertBundle, error) {
 	certTemplate := &x509.Certificate{
 		SerialNumber:   serialNumber,
 		Subject:        data.params.Subject,
+		NotBefore:      time.Now().Add(-30 * time.Second),
 		NotAfter:       data.params.NotAfter,
 		SubjectKeyId:   subjKeyID[:],
 		AuthorityKeyId: caCert.SubjectKeyId,