openssl: Fail CRL validity check if thisUpdate is in the future

diff --git a/src/libstrongswan/plugins/openssl/openssl_crl.c b/src/libstrongswan/plugins/openssl/openssl_crl.c
index 88f7a67c20c7bb2393747e40a1432c98b4b3f5a2..bb5f20dcffb082256c99ff3ac3f869c6cccc8acb 100644 (file)
--- a/src/libstrongswan/plugins/openssl/openssl_crl.c
+++ b/src/libstrongswan/plugins/openssl/openssl_crl.c
@@ -358,7 +358,7 @@ METHOD(certificate_t, get_validity, bool,
        {
                *not_after = this->nextUpdate;
        }
-       return t <= this->nextUpdate;
+       return (t >= this->thisUpdate && t <= this->nextUpdate);
 }
 
 METHOD(certificate_t, get_encoding, bool,