From 03ed6ac2dc62d160ea8be18927433380483c055c Mon Sep 17 00:00:00 2001 From: Anmol Sethi Date: Thu, 19 Oct 2017 18:29:43 -0400 Subject: [PATCH] crypto/x509/pkix: consider now==NextUpdate to be expired. If the current time is equal to the NextUpdate time, then the CRL should be considered expired. Fixes #22568. Change-Id: I55bcc95c881097e826d43eb816a43b9b377b0265 Reviewed-on: https://go-review.googlesource.com/71972 Reviewed-by: Adam Langley Reviewed-by: Filippo Valsorda Run-TryBot: Adam Langley TryBot-Result: Gobot Gobot --- src/crypto/x509/pkix/pkix.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/crypto/x509/pkix/pkix.go b/src/crypto/x509/pkix/pkix.go index 4dfbb6c81f..3cf884e4eb 100644 --- a/src/crypto/x509/pkix/pkix.go +++ b/src/crypto/x509/pkix/pkix.go @@ -247,9 +247,9 @@ type CertificateList struct { SignatureValue asn1.BitString } -// HasExpired reports whether now is past the expiry time of certList. +// HasExpired reports whether certList should have been updated by now. func (certList *CertificateList) HasExpired(now time.Time) bool { - return now.After(certList.TBSCertList.NextUpdate) + return !now.Before(certList.TBSCertList.NextUpdate) } // TBSCertificateList represents the ASN.1 structure of the same name. See RFC