Validating Certs w/out reliable source of Time

Hi all,

I am struggling with one issue that we have been seeing more and more 
often with the introduction of small IoT devices that connect to clouds 
and need to validate the other party's certificate chain.

In particular, the problem is that without a reliable (or trusted) 
source of Time information, devices can not really validate certificates 
(i.e., is the certificate even valid... ? is it expired ? is the 
revocation info fresh enough ?) and my question for the list is about 
best practices in the space.

Do you know if there are indications / best practices from ITU or from 
IETF (or other organizations) on how to deal with this issue ?

Cheers,
Max

-- 
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
OpenCA Logo

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix