tls: backdate certificate NotBefore by 24 hours to tolerate clock skew#10591
tls: backdate certificate NotBefore by 24 hours to tolerate clock skew#10591sdodson wants to merge 1 commit into
Conversation
VMs can boot with their hardware clock set to local time rather than UTC. On a host in UTC-5, that means the system clock reads five hours behind UTC at boot, before NTP has a chance to correct it. Any certificate whose NotBefore equals the wall-clock time of generation will appear "not yet valid" to that VM for up to five hours, blocking TLS handshakes during bootstrap. Setting NotBefore to time.Now()-24h ensures the certificate is already valid on any host whose clock is up to 24 hours behind the generator's clock. NotAfter is unchanged, so the effective validity window simply shifts: it starts 24 hours earlier and ends at the originally intended expiry time. SelfSignedCertificate and the image-based ingress operator signer both set NotBefore directly; signed certificates already inherit NotBefore from their signing CA, so they pick up the change automatically. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
WalkthroughThis PR adjusts the validity window of self-signed certificates by backdating their ChangesCertificate validity backdate
🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@sdodson is there a bug for this? if not, we can use no-jira, but curious about context. |
Not yet, I was mainly interested in using this to start the discussion on Slack. I'd assumed that there was some reasoning why we hadn't done this yet. I can open a bug once we agree we should, I'm not sure given this has been a problem since day 1 that we'd bother backporting but that would at least allow us to do so. |
|
@sdodson: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Problem
When a VM's hardware clock (RTC) stores local time but the OS has no configuration telling it so, Linux reads the hwclock assuming UTC. The resulting system clock is offset behind true UTC by the host's timezone difference—up to several hours—until NTP corrects it.
The certificate's
NotBeforeis a correct UTC timestamp, but from the VM's skewed perspective it appears to be in the future, so TLS handshakes fail during bootstrap with "certificate not yet valid".Change
Set
NotBeforetotime.Now() - 24hin the two places where self-signed certificates are created:pkg/asset/tls/tls.go—SelfSignedCertificatepkg/asset/imagebased/configimage/ingressoperatorsigner.go—selfSignedCertificateNotAfteris left unchanged, so the validity window simply shifts: it starts 24 hours earlier and ends at the originally intended expiry time. This tolerates a VM clock up to 24 hours behind true UTC.SignedCertificatealready inheritsNotBeforefrom its signing CA (caCert.NotBefore), so certificates in that path pick up the change automatically with no additional modifications needed.Testing
go build ./pkg/asset/tls/... ./pkg/asset/imagebased/configimage/...passes cleanly.