crypto/x509: always write validity times in UTC.

RFC 5280 section 4.1.2.5.1 says so.

R=golang-dev, bradfitz
CC=golang-dev
https://golang.org/cl/6775068

diff --git a/src/pkg/crypto/x509/x509.go b/src/pkg/crypto/x509/x509.go
index cfefbc5acec73f2999b22274b1d7b31b312e5085..5cfd09008ca0e65c0ae15b0a0e87e4af1daa0d84 100644 (file)
--- a/src/pkg/crypto/x509/x509.go
+++ b/src/pkg/crypto/x509/x509.go
@@ -1224,7 +1224,7 @@ func CreateCertificate(rand io.Reader, template, parent *Certificate, pub interf
                SerialNumber:       template.SerialNumber,
                SignatureAlgorithm: signatureAlgorithm,
                Issuer:             asn1.RawValue{FullBytes: asn1Issuer},
-               Validity:           validity{template.NotBefore, template.NotAfter},
+               Validity:           validity{template.NotBefore.UTC(), template.NotAfter.UTC()},
                Subject:            asn1.RawValue{FullBytes: asn1Subject},
                PublicKey:          publicKeyInfo{nil, publicKeyAlgorithm, encodedPublicKey},
                Extensions:         extensions,
@@ -1314,8 +1314,8 @@ func (c *Certificate) CreateCRL(rand io.Reader, priv interface{}, revokedCerts [
                        Algorithm: oidSignatureSHA1WithRSA,
                },
                Issuer:              c.Subject.ToRDNSequence(),
-               ThisUpdate:          now,
-               NextUpdate:          expiry,
+               ThisUpdate:          now.UTC(),
+               NextUpdate:          expiry.UTC(),
                RevokedCertificates: revokedCerts,
        }