chore: Allow certificates with timestamps in the future (#687)

raymondk · web-flow · commit df0d986fc2b6 · 2026-01-07T15:24:20.000-05:00
diff --git a/ic-agent/src/agent/mod.rs b/ic-agent/src/agent/mod.rs
@@ -949,10 +949,11 @@ impl Agent {
     }
 
     fn verify_cert_timestamp(&self, cert: &Certificate) -> Result<(), AgentError> {
+        // Verify that the certificate is not older than ingress expiry
+        // Certificates with timestamps in the future are allowed
         let time = lookup_time(cert)?;
         if (OffsetDateTime::now_utc()
             - OffsetDateTime::from_unix_timestamp_nanos(time.into()).unwrap())
-        .abs()
             > self.ingress_expiry
         {
             Err(AgentError::CertificateOutdated(self.ingress_expiry))

Original file line number	Diff line number	Diff line change
`@@ -949,10 +949,11 @@ impl Agent {`
`949`	`949`	`}`
`950`	`950`
`951`	`951`	`fn verify_cert_timestamp(&self, cert: &Certificate) -> Result<(), AgentError> {`
	`952`	`+ // Verify that the certificate is not older than ingress expiry`
	`953`	`+ // Certificates with timestamps in the future are allowed`
`952`	`954`	`let time = lookup_time(cert)?;`
`953`	`955`	`if (OffsetDateTime::now_utc()`
`954`	`956`	`- OffsetDateTime::from_unix_timestamp_nanos(time.into()).unwrap())`
`955`		`- .abs()`
`956`	`957`	`> self.ingress_expiry`
`957`	`958`	`{`
`958`	`959`	`Err(AgentError::CertificateOutdated(self.ingress_expiry))`