[s] we may need a bit of latitude on starting time for access certificates

[lawrence]

AccessError?: Adding Credential: Current time 07/06/2006 17:58:53 is before Attribute Certificate's not before time of 07/06/2006 18:01:50

Clock slippage may cause trouble ...

[lawrence]

Screenshot of the error message

[lawrence]

Damn, I thought this was only a problem on my laptop, but it appears to be a problem on glue too ... can we set a 10 minute earlier than real time as a temporary not before time (we might need all ndg sites to use ntp in the longer term).

[pjkersha]

Already come across this one :) You can make a 'window' to allow for clock slew by modifying the parameter

attCertNotBeforeOff

in the AA's configuration file /usr/local/NDG/conf/attAuthorityProperties.xml

Give a negative slew in seconds as required. It's currently set to -600 giving you a possible 10 minutes slew.

There's a note about using NTP in:

 http://bscw.badc.rl.ac.uk/bscw/bscw.cgi/d77103/NDG%20Security%20-%20Security%20Measures%20for%20Installation

This is the best long term solution. I will also explicitly raise it as a ticket.

[lawrence]

Still not resolved.

[lawrence]

Phil has found and fixed a bug which would have caused this. Assume it's fixed until we know different.