Set minimum date for EAP-TLS Cert Auth to work without NTP

[Santiago C]

Hi!

I am currently using an RT-AC68U (Merlin 378.55) with FreeRADIUS installed for EAP-TLS authentication for both main wireless networks (and no guest network enabled with intranet access) and while tinkering with my internet connection I found that whenever I restarted my router I was not able to connect to its Wifi in case no internet connection was found, since being the router unable to get the current time from a NTP server my SSL certificates were not yet valid and that prevented me from doing any kind of analysis of what was going on unless I connected via cable.

I know that using my own CA I could just make new certificated valid from 1970 but I though if was easy to create a quick script that runs on init and sets a minimum date of just one day past the initial validity of the certificates, here it is:

Save this as /jffs/scripts/checkdate.sh (you'll need to set the script as executable, have jffs enabled and everything else you need to run any script obviously)
Change vCutYear / vCutMonth / vCutDay to the minimum date your setup requires

#!/bin/sh
vYear=$(date +'%Y')
vMonth=$(date +'%m')
vDay=$(date +'%d')
vCutYear="2015"
vCutMonth="10"
vCutDay="04"
echo "$vYear/$vMonth/$vDay"

GoSetTempDate () {
    logger -t $(basename $0) "Setting Date to $vCutYear/$vCutMonth/$vCutDay"
    #echo "Setting Date to $vCutYear/$vCutMonth/$vCutDay"
    date -s "$vCutYear-$vCutMonth-$vCutDay 12:00:00"
}


if [ $vYear -lt $vCutYear ]; then
    GoSetTempDate
elif [ $vYear -eq $vCutYear ]; then
    if [ $vMonth -lt $vCutMonth ]; then
        GoSetTempDate
    elif [ $vMonth -eq $vCutMonth ]; then
        GoSetTempDate
    fi
fi

and invoke that on init from /jffs/scripts/init-start

sh /jffs/scripts/checkdate.sh

That should be it!

 

[RMerlin]

Take a look at the fakehwclock discussions posted a few weeks ago on the forums, they might also provide another alternative.

 

[Santiago C]

Take a look at the fakehwclock discussions posted a few weeks ago on the forums, they might also provide another alternative.

Thanks for the advice! I was thinking about a similar solution initially, but the learning curve towards a hardcoded solution was easier (I am just getting familiar with unix and shell scripting)