Re: [TLS] Server time

[Jeffrey Walton <[e-mail]>]

> In certain circumstances, using a HTTPS server as a time source isn't a
> horrible idea, but why change TLS for such an edge case?
Well, that edge case is going to inundate us in years to come.

There will be hundreds  of millions of PC sales in a year; hundreds of
millions to billions of smartphones sales in a year, and billions of
IoT gadget sales in a year. Not to mention all the SmartCard
applications that may need it.

Is SSL_VERIFY_NONE really the only choice for resource constrained and
low end devices?

> If there are use cases where it is important that time be acquired from an
> HTTPS, have the server return the timestamp at whatever precision desired as
> the body of the response to the GET request - it's still simple to work
> with, and doesn't impact all TLS users as this would.
>
Doesn't that set-up the chicken-and-the-egg problem? Channel setup
will never occur because of the failed certificate validation due to
the time skew at the client.

Or maybe it won't matter because the folks programming the system will
helpfully add SSL_VERIFY_NONE.

Anyway, I'm not arguing either way. I just know what I've experienced
in the past, and I expect it to happen again in the future.