Ignore time validation in UVM endorsements when resolving didx509 (#…

…5885)
microsoft · Jan 4, 2024 · 1a6c958 · 1a6c958
1 parent 076ec8b
commit 1a6c958
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/.daily_canary b/.daily_canary
@@ -1,4 +1,5 @@
    -^-     ___           ___
   (- -)   (= =)   |     Y   &  +--?
  (  V  ) /  .  \  |    +---=---'
-/--x-m- /--n-n---xXx--/--yY------>>>----<<<>>]]{{}}---||-/\---..
+/--x-m- /--n-n---xXx--/--yY------>>>----<<<>>]]{{}}---||-/\---..
+2024
diff --git a/src/node/uvm_endorsements.h b/src/node/uvm_endorsements.h
@@ -282,7 +282,11 @@ namespace ccf
 
     const auto& did = phdr.iss;
 
-    auto did_document_str = didx509::resolve(pem_chain, did);
+    auto did_document_str = didx509::resolve(
+      pem_chain,
+      did,
+      true // Ignore time validation (allow expired certs)
+    );
     did::DIDDocument did_document = nlohmann::json::parse(did_document_str);
 
     if (did_document.verification_method.empty())