Provide a 1 day grace period for the 'notBefore' test on certificates.

Author: michaelrsweet

cups/tls-gnutls.c

@@ -1005,7 +1005,7 @@ cupsGetCredentialsTrust(
     time_t	curtime;		// Current date/time
 
     time(&curtime);
-    if (curtime < gnutls_x509_crt_get_activation_time(certs[0]) || curtime > gnutls_x509_crt_get_expiration_time(certs[0]))
+    if ((curtime + 86400) < gnutls_x509_crt_get_activation_time(certs[0]) || curtime > gnutls_x509_crt_get_expiration_time(certs[0]))
     {
       _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, _("Credentials have expired."), true);
       trust = HTTP_TRUST_EXPIRED;

cups/tls-openssl.c

@@ -1028,7 +1028,7 @@ cupsGetCredentialsTrust(
 
     DEBUG_printf("1cupsGetCredentialsTrust: curtime=%ld, notBefore=%ld, notAfter=%ld", (long)curtime, (long)openssl_get_date(cert, 0), (long)openssl_get_date(cert, 1));
 
-    if (curtime < openssl_get_date(cert, 0) || curtime > openssl_get_date(cert, 1))
+    if ((curtime + 86400) < openssl_get_date(cert, 0) || curtime > openssl_get_date(cert, 1))
     {
       _cupsSetError(IPP_STATUS_ERROR_CUPS_PKI, _("Credentials have expired."), true);
       trust = HTTP_TRUST_EXPIRED;