curl / Mailing Lists / curl-library / Single Mail


Re: Unknown system time | feature discussion

From: Rainer Canavan <>
Date: Thu, 26 Jul 2018 17:22:37 +0200

On Thu, Jul 26, 2018 at 3:35 PM Daniel Stenberg <> wrote:
> Secondly, it won't be used by the TLS libraries so things like certificate
> verficatons will likely fail anyway.
> A *much* better system that is actually likely to somewhat work globally would
> be if you have a hardcoded "reasonable" date (like the date of your most
> recent build) that you set your system to at boot and then everything in the
> system will work as if that date is real... (it could be based on the same
> time you imagine you'd use as a basis for the time() callback you suggest)

That's indeed better, but it will still fail if updated certificates
are not yet valid at
build time.

OCSP (not stapled, but with an explicit request to the provider) may be
a workaround for that, but would still require support from the TLS library.

Received on 2018-07-26