Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Let's say we have an SSL certificate for a site. According to a web browser, the certificate expires tomorrow, Dec 10 2011.

OK, but that glosses over time zones. When will it expire, exactly?

  • 00:00 local time of the server (e.g. ET)
  • 00:00 local time of the user browsing the site (wherever)
  • 00:00 UTC

?

(Context of question: An admin who likes to wait until the last day before expiration, to set up the new cert. Why? To "get the most value out of it", he says. I don't follow that logic, exactly, and probably he should just replace it a few days earlier? But anyway I'm concerned/curous whether the cert may stop working for some/all users, before 00:00 our local time.)

share|improve this question
    
P.S. I guess a sub-question would be, in addition to the timezone, what actual time on the date does it expire? The obvious choices being 00:00 and 23:59, I suppose. –  Greg Hendershott Dec 9 '11 at 17:08
2  
That admin is an idiot. All major cert vendors will issue a renewal early and keep the end-date the same as if you had renewed it on the last day. –  MDMarra Dec 9 '11 at 17:10
2  
To get the most value out of it? If is is renewing his cert with the same vendor that doesn't apply.. Renewed certificates from the vendors I work with are always appended to the end of the current cert's date. –  Tim Brigham Dec 9 '11 at 17:10
add comment

1 Answer

up vote 9 down vote accepted

Your admin is $LESS_THAN_INTELLIGENT. Almost all cert vendors will renew a cert for the additional whole year (or whatever time frame) for a month or so before the previous expires. So if your cert was good for Dec 10, 2010 to Dec 10, 2011; you can get a new cert in November and it'll be good for Nov 20, 2011 to Dec 10, 2012. That way you don't have to fart around with "getting the most value out of it".

To actually answer the question, certs specify the time down to the minute, and include a time zone.

You can feed your public cert through openssl x509 -in Certificate_File.cer -text and it will output the Validity range. The following is from my personal website's from last year:

Not Before: Apr 20 20:48:59 2010 GMT
Not After : Jun  5 01:52:13 2011 GMT

Note that I renewed more than a full month in advance.

share|improve this answer
    
Oh, your edit beat me to it ;) –  Shane Madden Dec 9 '11 at 17:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.