JDK-6744888 : OCSP validation code should permit some clock skew when checking validity of OCSP responses
  • Type: Bug
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 6u10
  • Priority: P2
  • Status: Closed
  • Resolution: Won't Fix
  • OS: solaris_10
  • CPU: sparc
  • Submitted: 2008-09-04
  • Updated: 2010-05-11
  • Resolved: 2008-09-09
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 6 JDK 7 Other
6u10Fixed 7Fixed OpenJDK6Fixed
Related Reports
Relates :  
JDK-6787645 - CRL validation code should permit some clock skew when checking validity of CRLs
Relates :  
JDK-6569795 - Don't present security dialog for Sun-signed binaries
Description
The OCSP validation code should permit some clock skew when checking the validity
of OCSP responses. Currently, the system clock and the OCSP server clock have to
be exactly synchronized or the following exception will be thrown:

                throw new IOException("Response is unreliable: its validity " +
                    "interval is out-of-date");
Comments
EVALUATION This is an issue that needs to be fixed for 6569795 (plugin tests are failing). A small amount of clock skew should be tolerated and is also permitted in other OCSP implementations.
04-09-2008
SUGGESTED FIX A default clock skew should be permitted (ex: 20 minutes). Ideally this default could be overridden via an OCSP system or security property, but due to time constraints a separate CR will be opened for that feature.
04-09-2008