Table of Contents

Signed timestamp error margin

Name

  TIMESTAMP_ERROR_MARGIN

Header file

Configured via config/crypto.h.

Examples

Allow no more than five minutes of error

  #undef TIMESTAMP_ERROR_MARGIN
  #define TIMESTAMP_ERROR_MARGIN ( 5 * 60 )

Allow up to ten years of error

  #undef TIMESTAMP_ERROR_MARGIN
  #define TIMESTAMP_ERROR_MARGIN ( 10 * 365 * 24 * 60 * 60 )

Description

This build option configures the margin of error (in seconds) that will be accepted in any cryptographically signed timestamps (such as X.509 certificate expiry times).

See also

Notes

The default value for TIMESTAMP_ERROR_MARGIN is slightly more than twelve hours: this is intended to allow for the fact that there is no viable way for iPXE to determine its local time zone, and so there may be an error of up to twelve hours in the local system time as determined by iPXE.

You should not reduce TIMESTAMP_ERROR_MARGIN below twelve hours unless you can guarantee that the local system clock will always be set to GMT.