Reporting certificate lifetimes?

[mlichvar]

I was wondering if it would be useful to extend the server list with observed certificate lifetimes. Admins of computers that don't have an RTC, relying on a timestamp stored on the disk (e.g. the chronyd -s option), might prefer servers with longer lifetimes to avoid failing the certificate time checks.

As an example, Ubuntu provides ntp-bootstrap.ubuntu.com using a self-signed certificate with a validity spanning decades specifically for this use case.

[jauderho]

@mlichvar I'm not opposed to doing so but have some concerns about how wide the table will get if another column is added.

• What were your thoughts to tracking this?
  -- Adding a notafter: field to each entry in nts-sources.yml?
• What format should the dates be stored/displayed?
  -- Unix timestamp in nts-sources.yml and UTC in README.md?

[google-labs-jules]

Jules is on it. When finished, you will see another comment and be able to review a PR.

[google-labs-jules]

Ready for a review! A PR has been created.

[mlichvar]

Thanks for looking into it.

I'd suggest to write it as an interval rounded to whole days, weeks, months, or years. It could use a "d", "w", "m", "y" suffix if it needs to be as short as possible.

[jauderho]

Jules did a nice initial job with a draft PR although I would probably change the field name.

I did just realize that if we add this that the timeframes would need to be updated fairly regularly. I'll have to think about how to do that.