cchandler/certificate_authority — pull request #38 by databus23 (2014-04-17 12:52:55+00:00)
Title: Add last_update time offset option to crls

Using `Time.now` for the `last_update` field of the crls is problematic when validating clients clocks are out of sync. At least openssl refuses to validate a certificate when crl checking is enabled and the locally cached crl is not yet valid.
Therefore it is common practice to generate crls with a last_update timestamp that is slightly in the past.