up vote 2 down vote favorite
share [g+] share [fb]

I tried to gernerate my own root CA with a validity of 40 years as follow: openssl req -new -newkey rsa:4096 -x509 -days 10950 -extensions v3_ca -keyout myca.key -out myca.crt -config /etc/ssl/openssl.cnf

So far so good, finally let's take a look at the certificate with openssl x509 -noout -text -in myca.crt:

   Signature Algorithm: sha1WithRSAEncryption
    Issuer: C=DE, ST=Berlin, L=Berlin, O=Org, OU=Unit, CN=My Root CA/emailAddress=info@my.root.ca
    Validity
        Not Before: Jan 31 14:07:06 2012 GMT
        Not After : Dec 18 07:38:50 1905 GMT

Why is the valid to date (not after date) wrong in the certificate? And what can be done to correct this?

Some testing showed, that the overflowing occurs somewhere in January 2038..

link|improve this question
95% accept rate
I noticed that too, but on another platform: pfSense 2.x GUI. When creating a CA with a lifetime above 30y the expiration date will be 1.1.1970. Just to say this might be a generic OpenSSL bug/feature. – weeheavy Jan 31 at 14:47
feedback

2 Answers

up vote 5 down vote accepted

Found the problem: (keywords "openssl time_t 32bit")

http://projects.puppetlabs.com/projects/1/wiki/SSL_in_The_Year2038

The "fix" in my opinion is to generate your CA on a system with 64-bit OpenSSL.

link|improve this answer
i've just created my cert on a 64-bit OS :-) – JMW Feb 6 at 10:24
feedback
up vote -3 down vote

try a check in openssl user guide, www.openssl.org/docs/fips/UserGuide-1.1.1.pdf.

link|improve this answer
Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Iain♦ Feb 1 at 7:23
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.