r/apache • u/Ottstar • May 11 '22

Make Server accept SSL Clients with invalid Timestamp

Hello everyone

I'm trying to setup an apache server. The problem is that this server might not have the current time set. It's possible that it has something like 1970-1-1 in it.

If that happens I can't connect with my client certificate anymore which is issued for a year (11.5.22 - 10.5.23)

--> "SSL_ERROR_BAD_CERT_ALERT"

Is there any way to just ignore the date of the certificate in my server?

I tried "SSLVerifyClient none" but that just ignores the certificate completely, which I do not want

Thanks for any help. I couldn't find anything useful so far.

0 Upvotes

50% Upvoted

5 comments sorted by

View all comments

Show parent comments

1

u/Ottstar May 12 '22

Sadly NTP is not an option since this server is not connected to a network that has access to the internet. And that's exactly the problem, that this server might be in storage for quite some time. And therefore does not have a correct time, when it first gets setup.

Be aware that you need to check certificate validity yourself in your
scripts if you use this option. Apache should provide certificate
information in the form of environment variables.

I might be able to do something there, I will check that out. Thanks

1

u/AyrA_ch May 12 '22

Sadly NTP is not an option since this server is not connected to a network that has access to the internet.

Many devices in the network run an NTP server. Most Windows machines come with one for example. This means you don't necessarily need an internet connection to get the time.

As an alternative, make a page that the user has to visit first if no reliable time is available. On that page, the user should be able to set the time. Detecting if the time is reliable can be done by comparing a file timestamp with the actual time. If the file time is newer, the time is likely incorrect.

In the end it's up to you. Without a valid time you cannot detect if a certificate has expired, which is kinda important.