Re: [Ntp] Getting started using NTS -- clock accuracy vs certificates

[Miroslav Lichvar <[e-mail]>]

On Fri, Jul 29, 2022 at 11:11:19AM -0700, Hal Murray wrote:
> What happens if the system sits on the shelf for a month?  The system will try 
> to verify certificate chains with a clock that is a month out of date.
> 
> Do certificate geeks consider that case?  When they setup a new certificate, 
> do they back-date the starting time or just use "now"?  If not, then the max 
> clock error is the time since the certificate was issued.

For clients without RTC/battery the server can have a special name
using a self-signed certificate with validity extending to distant
past and future. The name and the certificate can be baked in the OS
image and updated by the OS-specific update mechanism as necessary.

It would be nice if the widely known NTS servers had this.

-- 
Miroslav Lichvar