upstream/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2026-02-03 20:40:45 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Fix return certificate expiry time from NearExpiration (#29128)

Browse source 
* Fix return certificate expiry time from NearExpiration

 - The duration returned from the NearExpiration is supposed to
   represent the time till expiry from now and not the calculated
   time a month from now.

* Add cl

* PR feedback
This commit is contained in:
Steven Clark 2024-12-09 13:39:00 -05:00 committed by GitHub
parent 5701c5b492
commit 56fa43f73f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 13 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
changelog/29128.txt Normal file
View file

@ -0,0 +1,3 @@
```release-note:bug
vault/diagnose: Fix time to expiration reporting within the TLS verification to not be a month off.
```

18
vault/diagnose/tls_verification.go
View file

@ -270,15 +270,17 @@ func TLSFileWarningChecks(leafCerts, interCerts, rootCerts []*x509.Certificate)
return warnings, nil
}
// NearExpiration returns a true if a certficate will expire in a month and false otherwise
// NearExpiration returns a true if a certificate will expire in a month
// and false otherwise, along with the duration until the certificate expires
// which can be a negative duration if the certificate has already expired.
func NearExpiration(c *x509.Certificate) (bool, time.Duration) {
oneMonthFromNow := time.Now().Add(30 * 24 * time.Hour)
var timeToExpiry time.Duration
if oneMonthFromNow.After(c.NotAfter) {
timeToExpiry := oneMonthFromNow.Sub(c.NotAfter)
return true, timeToExpiry
}
return false, timeToExpiry
now := time.Now()
timeToExpiry := c.NotAfter.Sub(now)
oneMonthFromNow := now.Add(30 * 24 * time.Hour)
isNearExpiration := oneMonthFromNow.After(c.NotAfter)
return isNearExpiration, timeToExpiry
}
// TLSMutualExclusionCertCheck returns error if both TLSDisableClientCerts and TLSRequireAndVerifyClientCert are set