Option to ignore certificate validity expiry time?

[jignatius]

openssl provides the -no_check_time option to "ignore certificate validity time".

Example:

$ openssl verify -CAfile cert1.pem  -CApath ./ cert2.pem  
...
error 10 at 1 depth lookup: certificate has expired
...
error 10 at 0 depth lookup: certificate has expired
error cert2.pem: verification failed

$ openssl verify -no_check_time -CAfile cert1.pem -CApath ./ cert2.pem  
cert2.pem: OK

Is there any way this could be done with xmlsec? If not, is there any plan to introduce such an option?

[lsh123]

There is --verification-time option for xmlsec command line utility to enable verification at a given point in time. Please create an issue if this is not enough and you need "no check time" option instead.

[lsh123]

Added a flag that currently works with openssl and gnutls (see PR #853 and issue #852).