# std.crypto.tls.Certificate: verify time validity · gitcafe/zig

[View on GitCafe](https://git.cafe/gitcafe/zig/commit/7cb535d4b54a4e5627edc6b558d1f31b41651328)

Repository: [gitcafe/zig](https://git.cafe/gitcafe/zig)

Visibility: public

Requested revision: 7cb535d4b54a4e5627edc6b558d1f31b41651328

Requested commit: 7cb535d4b54a4e5627edc6b558d1f31b41651328

Commit: 7cb535d4b54a4e5627edc6b558d1f31b41651328

Tree: 98dbf7e28271b958ab12593fa3fff2fa3da0c56c

Author: Andrew Kelley

Committer: Andrew Kelley

## Message

```
std.crypto.tls.Certificate: verify time validity

When scanning the file system for root certificates, expired
certificates are skipped and therefore not used for verification in TLS
sessions. There is only this one check, however, so a long-running
server will need to periodically rescan for a new Certificate.Bundle
and strategically start using it for new sessions. In this commit I made
the judgement call that applications would like to opt-in to root
certificate rescanning at a point in time that makes sense for that
application, as opposed to having the system clock potentially start
causing connections to fail.

Certificate verification checks the subject only, as opposed to both the
subject and the issuer. The idea is that the trust chain analysis will
always check the subject, leading to every certificate in the chain's
validity being checked exactly once, with the root certificate's
validity checked upon scanning.

Furthermore, this commit adjusts the scanning logic to fully parse
certificates, even though only the subject is technically needed. This
allows relying on parsing to succeed later on.

```

## Parents

- [862ecf23442b7b399f07400c8997c6481f329853](https://git.cafe/gitcafe/zig/commit/862ecf23442b7b399f07400c8997c6481f329853?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zig/tree/7cb535d4b54a4e5627edc6b558d1f31b41651328?format=markdown)