Certificate expiration not checked by gnutls-cli [GNUTLS-SA-2009-3] [CVE-2009-1417]

[Andreas Metzler]

On 2010-01-17 Nikos Mavrogiannopoulos <nmav at gnutls.org> wrote:
> Andreas Metzler wrote:
> > Ping?
> [...]
> >> this test does not work for me with any version of gnutls. There is no
> >> "error: certificate has expired" or even "Peer's certificate chain
> >> uses expired certificate".

> I checked it and it seems that the verification code will stop once a
> certificate in the chain is found invalid (that was added to counter
> some denial of service attacks). Here gnutls-cli cannot verify the CA
> certificate thus stops there and does not move forward to check time for
> the actual certificate.

I see and have managed to verify this. Thank you for the explanation.

cu andreas
-- 
`What a good friend you are to him, Dr. Maturin. His other friends are
so grateful to you.'
`I sew his ears on from time to time, sure'