{"action":"opened","issue":{"url":"https://api.github.com/repos/tlsnotary/pagesigner/issues/11","labels_url":"https://api.github.com/repos/tlsnotary/pagesigner/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/tlsnotary/pagesigner/issues/11/comments","events_url":"https://api.github.com/repos/tlsnotary/pagesigner/issues/11/events","html_url":"https://github.com/tlsnotary/pagesigner/issues/11","id":79106664,"number":11,"title":"Expired certificate handling","user":{"login":"AdamISZ","id":4278257,"avatar_url":"https://avatars.githubusercontent.com/u/4278257?v=3","gravatar_id":"","url":"https://api.github.com/users/AdamISZ","html_url":"https://github.com/AdamISZ","followers_url":"https://api.github.com/users/AdamISZ/followers","following_url":"https://api.github.com/users/AdamISZ/following{/other_user}","gists_url":"https://api.github.com/users/AdamISZ/gists{/gist_id}","starred_url":"https://api.github.com/users/AdamISZ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AdamISZ/subscriptions","organizations_url":"https://api.github.com/users/AdamISZ/orgs","repos_url":"https://api.github.com/users/AdamISZ/repos","events_url":"https://api.github.com/users/AdamISZ/events{/privacy}","received_events_url":"https://api.github.com/users/AdamISZ/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-21T18:17:00Z","updated_at":"2015-05-21T18:17:00Z","closed_at":null,"body":"User found that a previously validated pagesigner notarization file was shown as invalid in the manager table. Attempting to re-import failed.\r\n\r\nAfter some investigation (for future reference, a user can extract the cert from the pgsg with this script: github.com/tlsnotary/pagesigner-browserless/src/auditee/parse-pgsg.py, usage: python parse-pgsg.py <path to pgsg file> , and then extract cert on command line with openssl: `openssl x509 -in 0.der -inform der -text -noout -fingerprint` for example. This script is primitive and can be extended later), we found that the certificate was expired in the meantime.\r\n\r\nWhat's the correct behaviour in this case? The user wants the file to be shown, of course, so we could have a new status for an existing notarization: \"expired\", but it should not necessarily be seen as a failure mode. It can usually (always?) be verified that the time of the notarization was before the end of the valid period for the certificate by checking the date in the HTTP header of the server response."}}