Do not check a pinned certificate's dates

A pin trusts one exact certificate, so an expired one or an engine clock that is off no longer locks a device out (X509_V_FLAG_NO_CHECK_TIME).
2026-10-07 10:11:08 +02:00
parent cd6f8fec55
commit d482b32970
3 changed files with 117 additions and 0 deletions
@@ -266,6 +266,9 @@ except httpx.ConnectError as exc:
 - Any other certificate is refused in the handshake, before a key or a command
  is sent. `raise_if_changed` turns that refusal into `CertificateChanged`,
  which names the new SHA-256 and the key to clear, under the node type given.
+- The pinned certificate's dates are not checked: a pin trusts that exact
+  certificate, so one that expired, or an engine clock that is off, does not
+  lock the device out.
 - Clearing the key accepts whatever the device presents next.

 ## Lifecycle