I would say this only concerns very rare circumstances where a new installation of DCP-o-matic is used immediately for the creation of encrypted content to be played out 'immediately'. Admittedly, it can happen. Some Dolby media blocks have clocks with unusually high drift rates, and if not corrected on a regular basis, can drift multiple days. And maybe this could also cause problems with the signing certificate if the server is picky.

I can see no reason why the certificate validity period couldn't be set to start a few days from the past.

• Carsten

On a side note - our Sony was installed in March 2013. It was delivered from Japan sometime in February 2013. It was one of the very first units to be installed.

The media block certificate validity window is:

Tue, Dec 18, 2012 09:16 UTC — Thu, Dec 11, 2042 09:26 UTC

I've added checks into DoM v2.15.x which complain if the KDM validity period is outside (or close to being outside) the validity period of the certs, so this is more important now; as it stands, you can't install DoM then make a KDM starting on the same day (it seems wise to reject times which are close, to avoid timezone difficulties).

Sadly, setting the start time of certificates with OpenSSL the way DoM currently does it is very awkward, so this will need some work.

@carl seems like the options are

• use openssl ca not openssl x509
• remove these calls altogether and use the library direct
• patch openssl so we can use x509 but specify start date

@carl given the upheaval with any of these maybe it's time to do it "right" (i.e. option 2); having said that, there is so much horrid code in those front ends that it might be too painful. Then 3 seems tempting; apart from anything else it seems rather risky only to bundle the openssl binary on Windows (as we do now) and option 3 would bundle it everywhere.

Exploring the openssl hack in the clone of openssl git on git.carlh.net

openssl is patched; openssl branch of dcpomatic git is built on v2.15.x and tries to add the openssl binary in all the right places.

Windows, ubuntu, appimage, fedora, mac seem to be ok.

d386392e79d59f0c5647b0d778348b72d7cd7069