<html><head></head><body><div class="yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div dir="ltr" data-setdir="false"><div><div dir="ltr" data-setdir="false">Would libfaketime or run_as_date help?</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><div><br></div></div><div dir="ltr">Date: Thu, 11 Jul 2019 10:48:39 -0400<br></div><div dir="ltr">From: Christopher Schultz <<a href="mailto:chris@christopherschultz.net" style="color: rgb(25, 106, 212); text-decoration-line: underline;" rel="nofollow" target="_blank">chris@christopherschultz.net</a>><br></div><div dir="ltr">To: <a href="mailto:stunnel-users@stunnel.org" style="color: rgb(25, 106, 212); text-decoration-line: underline;" rel="nofollow" target="_blank">stunnel-users@stunnel.org</a><br></div><div dir="ltr">Subject: Re: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date?</div><div dir="ltr"><br></div><div dir="ltr">Eric,<br></div><div dir="ltr"><br></div><div dir="ltr">(Coming back to this.)<br></div><div dir="ltr"><br></div><div dir="ltr">On 5/14/19 14:41, Eric Eberhard wrote:<br></div><div dir="ltr">> Chris,<br></div><div dir="ltr">> <br></div><div dir="ltr">> There are "real" certificates you purchase from a certificate authority and pay an annual fee. If this is https you pretty much need that or the user gets errors. By private I meant "self signed."<br></div><div dir="ltr">> <br></div><div dir="ltr">> However, openssl has an option to create a certificate. You type the name, address, whatever, and it makes a certificate. It is JUST AS GOOD as a purchased certificate (except https or perhaps others that want certificate authority certificates). I use them for FTP and SSH and many things .<br></div><div dir="ltr">> <br></div><div dir="ltr">> openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365<br></div><div dir="ltr">> <br></div><div dir="ltr">> You can put your own expire date(days) when you make the cert. A screen will come up and ask 20 questions :-) If you cannot do it (don't have openssl installed) I can do it for you. It certainly will work as a stop-gap. We don't need it for https as it is Apache on a machine that is hosted.<br></div><div dir="ltr"><br></div><div dir="ltr">So... everything above is exactly what we do with this vendor. We don't<br></div><div dir="ltr">have a problem getting a well-known-CA to sign the certificate. We have<br></div><div dir="ltr">(had) a problem with the vendor just getting the damned work done.<br></div><div dir="ltr"><br></div><div dir="ltr">Yes, I know it is a 5-minute process but when you are dealing with a big<br></div><div dir="ltr">company where you have to have 6 managers in multiple time zones call<br></div><div dir="ltr">each other to confirm the problem, have a meeting about the solution,<br></div><div dir="ltr">determine a course of action, allocate a resource to perform the work,<br></div><div dir="ltr">QA the solution, then get an IT review of everything before placing<br></div><div dir="ltr">something into production, that 5-minute fix can take days or weeks.<br></div><div dir="ltr"><br></div><div dir="ltr">I just wanted to say "I still trust this certificate, even though it has<br></div><div dir="ltr">expired."<br></div><div dir="ltr"><br></div><div dir="ltr">Is that possible to do without recompiling stunnel?<br></div><div dir="ltr"><br></div><div dir="ltr">Thanks,<br></div><div dir="ltr">-chris<br></div><div dir="ltr"><br style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;"></div></div><br></div></div></body></html>