Linux Kernels

X.509: Support leap seconds

This change “X.509: Support leap seconds” (commit da02559) in Linux kernel is authored by David Howells <dhowells [at]> on Wed Feb 24 14:37:53 2016 +0000.

Description of "X.509: Support leap seconds"

The change “X.509: Support leap seconds” introduces changes as follows.

X.509: Support leap seconds

The format of ASN.1 GeneralizedTime seems to be specified by ISO 8601
[X.680 46.3] and this apparently supports leap seconds (ie. the seconds
field is 60).  It's not entirely clear that ASN.1 expects it, but we can
relax the seconds check slightly for GeneralizedTime.

This results in us passing a time with sec as 60 to mktime64(), which
handles it as being a duplicate of the 0th second of the next minute.

We can't really do otherwise without giving the kernel much greater
knowledge of where all the leap seconds are.  Unfortunately, this would
require change the mapping of the kernel's current-time-in-seconds.

UTCTime, however, only supports a seconds value in the range 00-59, but for
the sake of simplicity allow this with UTCTime also.

Without this patch, certain X.509 certificates will be rejected,
potentially making a kernel unbootable.

Reported-by: Rudolf Polzer <>
Signed-off-by: David Howells <>
Acked-by: Arnd Bergmann <>
cc: David Woodhouse <>
cc: John Stultz <>

Linux kernel releases containing commit da02559

The Linux kernel releases containing this commit are as follows.

Linux kernel code changes from "X.509: Support leap seconds"

There are 2 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 crypto/asymmetric_keys/x509_cert_parser.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index 794cf0eac2c9..99ff5382b627 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -527,7 +527,7 @@ int x509_decode_time(time64_t *_t,  size_t hdrlen,
 	if (day < 1 || day > mon_len ||
 	    hour > 23 ||
 	    min > 59 ||
-	    sec > 59)
+	    sec > 60) /* ISO 8601 permits leap seconds [X.680 46.3] */
 		goto invalid_time;
 	*_t = mktime64(year, mon, day, hour, min, sec);

The commit for this change in Linux stable tree is da02559 (patch).

Last modified: 2020/01/11 06:51