derp: set NotBefore and NotAfter in DERP server's metacert
Fixes regression from that
only affected Windows users because Go only on Windows delegates x509
cert validation to the OS and Windows as unhappy with our "metacert"
lacking NotBefore and NotAfter.
Fixes
@@ -306,6 +306,9 @@ func (s *Server) initMetacert() {
Subject: pkix.Name{
CommonName: fmt.Sprintf("derpkey%x", s.publicKey[:]),
},
+ // Windows requires NotAfter and NotBefore set:
+ NotAfter: time.Now().Add(30 * 24 * time.Hour),
+ NotBefore: time.Now().Add(-30 * 24 * time.Hour),
}
cert, err := x509.CreateCertificate(crand.Reader, tmpl, tmpl, pub, priv)
if err != nil {
