cert considered invalid when intermediate is expired

[Nikos Mavrogiannopoulos]

On 10/28/2012 01:57 PM, James Cloos wrote:

>>>>>> "NM" == Nikos Mavrogiannopoulos <nmav at gnutls.org> writes:
> 
> NM> If the intermediate certificate is expired why would you consider it
> NM> valid? You may ignore expiration failures if your application doesn't
> NM> care, but gnutls cannot ignore them.
> 
> The presumption people normally make is that the validity period of a
> cert specifies when it can sign, not when it can verify.
> 
> If the cert was valid when the signature was made, validation is expected
> to continue to work for the lifetime of the signed cert.
> 
> As an example, one might want to issue signing certs to one's employees
> which are valid for one shift but used to sign documents which are valid
> for several years.  This ensures that were a signing cert compromised,
> there would be a very small window of opportunity and a small number of
> DoSed victims (ie, who have to come back for a fresh sig because the
> compromised signing cert was revoked).


This is a totally different use case than a TLS certificate chain
verification. You can do that by considering the expired certificates as
trusted while you verify the documents. That verification is application
specific.

In the TLS chain verification chain however, there is no way to know
whether the intermediate certificate is expected to be expired or
somebody managed to obtain the private key of an old expired CA
certificate and signed new certificates.

regards,
Nikos