<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<p style="color: #777777;">
<a href="https://gitlab.com/llqll">llqll</a>
commented:
</p>
<div style="">
<p dir="auto"><a href="https://gitlab.com/nmav" data-user="105950" data-reference-type="user" data-container="body" data-placement="bottom" class="gfm gfm-project_member" title="Nikos Mavrogiannopoulos">@nmav</a> hello，thanks for your advice. I verify the certificate by reverting <a href="https://gitlab.com/gnutls/gnutls/commit/8e7bc8fec48bf5748b08426ea183d18c2d7b52a9" data-original="https://gitlab.com/gnutls/gnutls/commit/8e7bc8fec48bf5748b08426ea183d18c2d7b52a9" data-link="false" data-link-reference="true" data-project="179611" data-commit="8e7bc8fec48bf5748b08426ea183d18c2d7b52a9" data-reference-type="commit" data-container="body" data-placement="bottom" title="Tolerate DER time encoding errors" class="gfm gfm-commit has-tooltip">8e7bc8fe</a>. And I used the new version of gnutls （gnutls3.6.11） to verify the certificate. The result is the same. gnutls3.6.11 accept the certificate with invalid notbefore field.</p>
<p dir="auto">I think this problem is different from <a href="https://gitlab.com/gnutls/gnutls/issues/207" data-original="https://gitlab.com/gnutls/gnutls/issues/207" data-link="false" data-link-reference="true" data-project="179611" data-issue="5536048" data-reference-type="issue" data-container="body" data-placement="bottom" title="do not tolerate DER encoded certificates with invalid time format" class="gfm gfm-issue has-tooltip">#207</a> because the notbefore field of the certificate conforms to der syntax.</p>
<p dir="auto">Through debugging I found the reason.</p>
<p dir="auto">gnutls uses atoi(x) to get the year, month and day values. When x cannot be converted to int, return 0 instead of error. In this case, x=" #" , after year=atoi(x), the value of year is 0. <a href="https://baike.baidu.com/item/atoi" rel="nofollow noreferrer noopener" target="_blank">https://baike.baidu.com/item/atoi</a>.</p>
<p dir="auto">the gnutls code is:
<a class="no-attachment-icon" href="https://user-content.gitlab-static.net/f48466794b8e819e7e48f64c3f507880de0b554e/68747470733a2f2f6769746875622e636f6d2f6c6c716c6c2f696d6167652f7261772f6d61737465722f63657274746f6f6c74696d652e706e67" target="_blank" rel="nofollow noreferrer noopener" data-canonical-src="https://github.com/llqll/image/raw/master/certtooltime.png"><img src="https://user-content.gitlab-static.net/f48466794b8e819e7e48f64c3f507880de0b554e/68747470733a2f2f6769746875622e636f6d2f6c6c716c6c2f696d6167652f7261772f6d61737465722f63657274746f6f6c74696d652e706e67" alt="image text" data-canonical-src="https://github.com/llqll/image/raw/master/certtooltime.png" style="max-width: 100%; height: auto;"></a></p>
<p dir="auto">In this case, x=" #" , after year=atoi(x), the value of year is 0. <a href="https://baike.baidu.com/item/atoi" rel="nofollow noreferrer noopener" target="_blank">https://baike.baidu.com/item/atoi</a>.</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #777;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/issues/870#note_260357431">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/sent_notifications/f639e39cca1a291692e1f2f4d3d20e16/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/issues/870#note_260357431"}}</script>
</p>
</div>
</body>
</html>