{"action":"closed","issue":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/545","labels_url":"https://api.github.com/repos/letsencrypt/boulder/issues/545/labels{/name}","comments_url":"https://api.github.com/repos/letsencrypt/boulder/issues/545/comments","events_url":"https://api.github.com/repos/letsencrypt/boulder/issues/545/events","html_url":"https://github.com/letsencrypt/boulder/issues/545","id":97712896,"number":545,"title":"Incoherent notAfter test in MatchesCSR","user":{"login":"r0ro","id":465562,"avatar_url":"https://avatars.githubusercontent.com/u/465562?v=3","gravatar_id":"","url":"https://api.github.com/users/r0ro","html_url":"https://github.com/r0ro","followers_url":"https://api.github.com/users/r0ro/followers","following_url":"https://api.github.com/users/r0ro/following{/other_user}","gists_url":"https://api.github.com/users/r0ro/gists{/gist_id}","starred_url":"https://api.github.com/users/r0ro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/r0ro/subscriptions","organizations_url":"https://api.github.com/users/r0ro/orgs","repos_url":"https://api.github.com/users/r0ro/repos","events_url":"https://api.github.com/users/r0ro/events{/privacy}","received_events_url":"https://api.github.com/users/r0ro/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/letsencrypt/boulder/labels/tests","name":"tests","color":"d4c5f9"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-07-28T13:52:35Z","updated_at":"2015-10-28T07:50:11Z","closed_at":"2015-10-28T07:50:11Z","body":"When ensuring that the generated certificated matches the CSR, there is a problem in the MatchesCSR function.\r\n```go\r\nif parsedCertificate.NotAfter.After(earliestExpiry) {\r\n\terr = InternalServerError(\"Generated certificate expires before earliest expiration\")\r\n\treturn\r\n}\r\n```\r\nthe test and the error message are not coherent.\r\nI'm not sure what the CA policy should be here, but I guess the authorizations should have a shorter life time (few days ?) than the issued certificate (one year ?), so the test should probably be :\r\n\r\n```go\r\nif parsedCertificate.NotAfter.Before(earliestExpiry) {\r\n\terr = InternalServerError(\"Generated certificate expires before earliest expiration\")\r\n\treturn\r\n}\r\n```\r\n\r\nBut in the end, I'm not sure this test is relevant at all.\r\nTo my mind, the certificate duration should not be linked to authorization duration. The CA should be able to issue 1 year certificate and chose to expire authorization after 1 day. \r\nThe only relevant thing to check before issuing a certificate, is that for each requested name, there is a least one valid authorization for this name that is not expired at the time the request is made.\r\n\r\nReference to related code sections: \r\nhttps://github.com/letsencrypt/boulder/blob/master/core/objects.go#L505\r\nhttps://github.com/letsencrypt/boulder/blob/master/ca/certificate-authority.go#L358 (also see: https://github.com/letsencrypt/boulder/commit/fc2c97168f4b3b0cce36ff28fd472c7f5e3bebd2)"}}