Improper Validation of Certificate Expiration
This vulnerability occurs when an application fails to properly check if a digital certificate has expired, potentially trusting certificates that are no longer valid due to their age.
Digital certificates have built-in expiration dates for security reasons, similar to how a driver's license needs renewal. When your application doesn't verify this expiration, it might continue to trust certificates that have been abandoned or revoked, creating a false sense of security in your authentication or encryption processes. This oversight completely undermines the certificate's purpose, as you cannot verify whether the certificate holder still has legitimate access. To prevent this, always implement proper date validation against the certificate's 'valid from' and 'valid to' timestamps during every verification routine.
Impact: Other
The data read from the system vouched for by the expired certificate may be flawed due to malicious spoofing.
Impact: Other
Trust afforded to the system in question - based on the expired certificate - may allow for spoofing attacks.
ID : DX-123
The following OpenSSL code ensures that there is a certificate and allows the use of expired certificates.Code Example:
c//do stuff*
Low
- CLASP