SSL in The Year2038
Version 2 (Anonymous, 03/13/2010 08:02 pm)
| 1 | 1 | # Puppet, OpenSSL and the Year 2038 |
|
|---|---|---|---|
| 2 | 1 | ||
| 3 | 1 | It would appear that 32 bit versions of OpenSSL (tested up 0.9.8g) |
|
| 4 | 1 | suffer from the Year 2038 bug |
|
| 5 | 1 | ([http://en.wikipedia.org/wiki/Year\_2038\_problem](http://en.wikipedia.org/wiki/Year_2038_problem)). |
|
| 6 | 1 | ||
| 7 | 1 | To recap, this is where the internal representation of time |
|
| 8 | 1 | (time\_t), a 32 bit signed integer that is the number of seconds |
|
| 9 | 1 | since the epoch (00:00:00 UTC on January 1, 1970). This means the |
|
| 10 | 1 | maximum time you can represent on a 32 bit system is 03:14:07 |
|
| 11 | 1 | 19/01/2038. OpenSSL apparently uses time\_t internally rather than |
|
| 12 | 1 | something more functional. |
|
| 13 | 1 | ||
| 14 | 1 | That upper limit does not apply to 64 bit OpenSSL where time\_t is |
|
| 15 | 1 | 64 bits. We have a somewhat larger margin. |
|
| 16 | 1 | ||
| 17 | 1 | The upshot of this is that you should not be asking Puppet to work |
|
| 18 | 1 | with certificates that pass beyond that date in 2038 if you use |
|
| 19 | 1 | *any* 32 bit systems (with the current OpenSSL libraries). |
|
| 20 | 1 | ||
| 21 | 1 | In practice this means the ca\_ttl parameter cannot be larger than |
|
| 22 | 1 | (03:14:07 19/01/2038 - now). At the time of writing, 30y will cause |
|
| 23 | 1 | a failure. |
|
| 24 | 1 | ||
| 25 | 1 | A fix for OpenSSL to use another internal representation of |
|
| 26 | 1 | time/date than 32 bit time\_t would fix this problem without having |
|
| 27 | 1 | to go to 64 bit. |
|
| 28 | 1 | ||
| 29 | 1 | To reproduce this with Puppet: |
|
| 30 | 1 | ||
| 31 | 1 | puppetca --ca_ttl=30y --ssldir=/var/tmp/catest --generate hopeless.nohoper.com |
|
| 32 | 1 | ||
| 33 | 1 | And directly with OpenSSL (accept all the defaults): |
|
| 34 | 1 | ||
| 35 | 1 | openssl req -new -x509 -keyout key1.pem -out cert1.pem -days 10000 |
|
| 36 | 1 | openssl req -new -x509 -keyout key2.pem -out cert2.pem -days 12000 |
|
| 37 | 1 | openssl x509 -noout -text -in cert1.pem |
|
| 38 | 1 | openssl x509 -noout -text -in cert2.pem |
|
| 39 | 1 | ||
| 40 | 1 | Key1 is the control (which works), and Key2 is the one which will |
|
| 41 | 1 | give an error. What should expire in the year 2040 actually expires |
|
| 42 | 1 | in the year 1904. |
|
| 43 | 1 | ||
| 44 | 1 | Puppet is at the mercy of the third-party libraries here. |