cert is not yet valid: before=260517035651Z (1778990211), now=301081

[ChristianSchulte]

Hello,

trying to run an application using mongosse things are not working for me due to the way certificate timestamps are compared against the value returned by mg_millis CLOCK_MONOTIC, I guess. The output in question is this line:

cert is not yet valid: before=260517035651Z (1778990211), now=301081

You can see that now is way off but the value shown in the message is the value returned by mg_now/mg_millis. If I change the corresponding lines in mg_millis to use CLOCK_REALTIME, things start working. Reading the various manual pages about clock_gettime, not a single one mentions that CLOCK_MONOTIC can be used to represent UTC dates. But that's what is assumed when comparing the certificate timestamps. I think CLOCK_MONOTONIC or CLOCK_MONOTONIC_RAW cannot be used to compare certificate dates with.

11f22288 4 mongoose.c:16076:mg_tls_hexd c x25519 sec: 46a62ce009c0483cab46bfb53e221a4f107788bce0b176cd274c8c86d7cfbf64
11f22288 4 mongoose.c:16076:mg_tls_hexd hs secret: db623016f38dcd67ef8e97a7a679449777db953ed7b73b38e33ba08a5529f08e
11f22288 4 mongoose.c:16076:mg_tls_hexd hello hash: d9f21ccaf4f78b5881be2cf5a755a50001bf1f2246cb75e2ea192a73583e6d83
11f22288 4 mongoose.c:16076:mg_tls_hexd s hs traffic: ff9eea46249de48d7c30ecb86c8320cf4c40b5d576bc8b96e38a11d93409da8f
11f22288 4 mongoose.c:16076:mg_tls_hexd s key: f6e67ebacc2e3b106365b3f697fd9f6235c16debb4a17c3527e3a1c793e652ef
11f22288 4 mongoose.c:16076:mg_tls_hexd s iv: f858db8fcbe463d0ab66c6b6
11f22288 4 mongoose.c:16076:mg_tls_hexd s finished: 9eea1e6eae28247817f4ef8173fb0d039ccc955f687046f1aff5e09f239c8dd5
11f22288 4 mongoose.c:16076:mg_tls_hexd c hs traffic: 5db43eebbe3767de72db035c38b6666a9378093fc8cd9ef7487cae1f8f76a394
11f22288 4 mongoose.c:16076:mg_tls_hexd c key: 77a98ccfa24935e9d23ea4b41f5f9ada2352a32ce3e05ffb84272da25e2ab392
11f22288 4 mongoose.c:16076:mg_tls_hexd c iv: d1aefeef14d271c518ffb161
11f22288 4 mongoose.c:16076:mg_tls_hexd c finished: b9cbfce2ab400e86e39a342cc6313f7ae9712b4c7690c9474bf635a34e1b1e38
11f22288 4 mongoose.c:17357:mg_tls_pars cert s/n: 2752a9c9b1f166b413e895a0adb0f323
11f22288 4 mongoose.c:17363:mg_tls_pars sig algo (oid): 2a8648ce3d040302
11f22288 4 mongoose.c:17367:mg_tls_pars sig algo: ECDSA with SHA256
11f22288 4 mongoose.c:17392:mg_tls_pars tbs hash: 7c458778dd7a1230bfb2bfe8db7d8ccd51a8475022d9d49e8c662e986845e47d
11f22288 4 mongoose.c:17304:mg_der_debu issuer: CN=WE1, C=US, O=Google Trust Services, OU=
11f22288 1 mongoose.c:17406:mg_tls_pars cert is not yet valid: before=260517035651Z (1778990211), now=301081
11f22288 1 mongoose.c:2279:mg_error 1 5 failed to parse certificate
coinbase: failed to parse certificate
11f22288 3 mongoose.c:13963:read_conn 1 5 774:0:2676 -2 err 25
11f22289 3 mongoose.c:7544:mg_close_con 1 5 closed
11f22298 4 mongoose.c:14377:mg_mgr_poll 2 -- tchrC 0 0
11f22298 3 mongoose.c:7544:mg_close_con 2 4 closed
11f22298 3 mongoose.c:7655:mg_mgr_free All connections closed

[ChristianSchulte]

The change in question seems to be this: #1615

Maybe mg_now() is/was supposed to return a UTC timestamp and stopped doing so due to mg_millis() no longer returning a UTC date after the change to CLOCK_MONOTONIC.

[scaprile]

mg_now() can't feed you wall clock if you don't tell it, Mongoose runs everywhere, and we don't know how you manage your timing.
You just need to provide a suitable timebase
That can be SNTP or your OS, (even though you don't say, you are referring to something that seems to be Unix clock)

Please see our documentation, and follow the guidelines in our tutorials.
https://mongoose.ws/documentation/tutorials/udp/sntp-time-sync/
https://mongoose.ws/documentation/tutorials/tls/

See our tests for example:

mongoose/test/unit_test.c

Lines 5370 to 5378 in 9bc4d97

	extern uint64_t mg_boot_timestamp_ms;
	int main(void) {
	const char *debug_level = getenv("V");
	if (debug_level == NULL) debug_level = "3";
	mg_log_set(atoi(debug_level));
	// make sure there is a time reference for mg_now() regardless of SNTP tests
	mg_boot_timestamp_ms = (uint64_t) time(NULL) * 1000;

mongoose/test/mip_x_test.c

Lines 508 to 553 in 9bc4d97

	#if MG_TLS
	static bool unixms(void) {
	bool res = false;
	#if MG_ARCH == MG_ARCH_UNIX
	struct timeval tv = {0, 0};
	gettimeofday(&tv, 0);
	mg_boot_timestamp_ms = (uint64_t)((int64_t) tv.tv_sec * 1000 + tv.tv_usec / 1000);
	res = true;
	#endif
	return res;
	}
	static void sntpcb(struct mg_connection *c, int ev, void *ev_data) {
	if (ev == MG_EV_SNTP_TIME) *(int64_t *) c->fn_data = *(int64_t *) ev_data;
	}
	static bool sntpms(struct mg_mgr *mgr, const char *url) {
	int64_t ms = 0;
	int i;
	mg_sntp_connect(mgr, url, sntpcb, &ms);
	for (i = 0; i < 50 && ms == 0; i++) {
	mg_mgr_poll(mgr, 0);
	usleep(10000); // 10 ms. Slow down poll loop to ensure packet transit
	}
	return ms > 0;
	}
	static void gettimefortls(struct mg_mgr *mgr) {
	// NOTE(): historical NTP port blockage issue; expect at least one to be
	// reachable and work. https://github.com/actions/runner-images/issues/5615
	if (sntpms(mgr, "udp://time.apple.com:123") ||
	sntpms(mgr, "udp://time.windows.com:123") || sntpms(mgr, NULL) ||
	unixms()) return;
	mg_boot_timestamp_ms = (uint64_t) time(NULL) * 1000;
	}
	#endif
	bool mip_x_test(struct mg_mgr *mgr) {
	host_ip = getenv("HOST_IP");
	host_ip6 = getenv("HOST_IPV6");
	#if MG_TLS
	// Feel free to move to other module to support more systems...
	gettimefortls(mgr);
	#endif

[ChristianSchulte]

Thanks. I noticed it myself. I was just confused and did not notice how time is implemented.

extern uint64_t mg_boot_timestamp_ms;

Setting a boot timestamp manually of course makes it work. Still wondering why it worked on Linux without that for years though.

[scaprile]

You also didn't mention that you've been using it and it stopped working.
We fixed this in 7.22, we wasn't checking proper issuance dates before.

[ChristianSchulte]

Application is deployed to Linux. It did not stop working there and it still is running there without any changes applied yet. Meanwhile I am questioning myself why it does work there at all. I compiled it on OpenBSD. It had issues with LibreSSL I could not figure out myself quickly so I switched to MG_TLS_BUILTIN there which then started displaying that debug message. I then tried to reproduce the LibreSSL issue on Linux again. Doing it that way:

struct mg_tls_opts ws_tls_opts = {0};
ws_tls_opts.name = mg_url_host(ws_uri);

I can use MG_TLS_BUILTIN flawlessly on Linux, OpenBSD and Windows. I do get the same issue on Linux with OpenSSL as on OpenBSD with LibreSSL that way, though. Whereas doing it that way:

struct mg_tls_opts ws_tls_opts = {
  .ca = mg_str(""),
  .cert = mg_str(""),
  .key = mg_str(""),
 .name = mg_url_host(ws_uri),
}

no issues with OpenSSL on Linux and Windows. I go with MG_TLS_BUILTIN and be done with it. Thank you.