Bug 3311 - Certificate validity "forever" is not documented in PROTOCOL.certkeys
Summary: Certificate validity "forever" is not documented in PROTOCOL.certkeys
Status: CLOSED INVALID
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: Documentation (show other bugs)
Version: -current
Hardware: All All
: P5 enhancement
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-05-13 11:57 AEST by Mariano Cano
Modified: 2022-02-25 13:57 AEDT (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mariano Cano 2021-05-13 11:57:15 AEST
PROTOCOL.certkeys does not document the special case when "valid before" is set to 0. A certificate like this will be always valid ("forever").


This is the current text in the PROTOCOL.certkeys:

```
"valid after" and "valid before" specify a validity period for the
certificate. Each represents a time in seconds since 1970-01-01
00:00:00. A certificate is considered valid if:

    valid after <= current time < valid before
```

With that description a certificate with valid before set to 0 will not be valid.
Comment 1 Damien Miller 2021-05-13 14:27:21 AEST
what special case are you referring to? AFAIK this is no such special case.
Comment 2 Mariano Cano 2021-05-13 15:58:20 AEST
The special case is that you can create an SSH certificate without expiration date if you set the valid before to 0.

See the flag -V in `man ssh-keygen`:

https://github.com/openssh/openssh-portable/blob/d3cc4d650ce3e59f3e370b101778b0e8f1c02c4d/ssh-keygen.1#L613-L643

I haven't tried to debug the code, but in /auth.c there's code to skip the expiration check if opts->valid_before is 0.

https://github.com/openssh/openssh-portable/blob/2dc328023f60212cd29504fc05d849133ae47355/auth.c#L963-L969

And that "forever" mode, as `man ssh-keygen` says, it is not documented on the PROTOCOL.certkeys
Comment 3 Damien Miller 2021-05-13 20:43:55 AEST
"forever" in ssh-keygen sets valid_after=0 and valid_before=0xffffffffffffffff, so that's not the case you're talking about here unless you're considering wall clock times before 1970 or many billions of years in the future: https://github.com/openssh/openssh-portable/blob/d3cc4d650ce3e59f3e370b101778b0e8f1c02c4d/ssh-keygen.c#L1954

The other case has nothing to do with certificates (note that the 'opts' variable here is not a key, but another type). It is to support the authorized_keys "expiry-time" keyword: https://github.com/openssh/openssh-portable/blob/d3cc4d650ce3e59f3e370b101778b0e8f1c02c4d/sshd.8#L527
Comment 4 Mariano Cano 2021-05-14 05:27:17 AEST
You're right, didn't understand the `~` in `~(u_int64_t)0;`
Comment 5 Damien Miller 2022-02-25 13:57:58 AEDT
closing bugs resolved before openssh-8.9