Don't offer to save expired or not-yet-valid certificates. Closes #1943 as

a side-effect.

diff --git a/mutt_ssl.c b/mutt_ssl.c
index c06807bd1958250dc07d3f1a59db61c2fb507fa6..bc9a523dc800a3e946acf1a983c462a5b2213091 100644 (file)
--- a/mutt_ssl.c
+++ b/mutt_ssl.c
@@ -617,7 +617,8 @@ static int ssl_check_certificate (sslsockdata * data)
   snprintf (menu->dialog[row++], SHORT_STRING, _("Fingerprint: %s"), buf);
 
   menu->title = _("SSL Certificate check");
-  if (SslCertFile)
+  if (SslCertFile && X509_cmp_current_time (X509_get_notAfter (data->cert)) >= 0
+      && X509_cmp_current_time (X509_get_notBefore (data->cert)) < 0)
   {
     menu->prompt = _("(r)eject, accept (o)nce, (a)ccept always");
     menu->keys = _("roa");