Stop reporting certificate expiry for self-signed trust fabric certif…

…icates. See ukf/ukf-meta#189
InCommon · Sep 23, 2019 · dcd6955 · dcd6955
1 parent 6a7c457
commit dcd6955
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/utilities/check_embedded.pl b/utilities/check_embedded.pl
@@ -324,8 +324,9 @@ sub comment {
         #print "   text lines: $#lines\n";
 
         #
-        # Deal with certificate expiry.
+        # Deal with certificate expiry for CA-issued certificates.
         #
+        if ($issuer ne $subject) {
         if ($days < -$longExpiredDays) {
             my $d = floor(-$days);
             if (defined($expiry_whitelist{$fingerprint})) {
@@ -348,7 +349,7 @@ sub comment {
             $days = int($days);
             warning("expires in $days days ($notAfter)");
         }
-
+	}
 
         #
         # Handle public key size.