Added a flag for bypassing validity check

bless/aws_lambda/bless_lambda.py

@@ -122,9 +122,11 @@ def lambda_handler(event, context=None, ca_private_key_password=None,
         # certificate where valid_before < valid_after
         valid_before = current_time
         valid_after = current_time + 1
+        bypass_time_validity_check = True
     else:
         valid_before = current_time + certificate_validity_after_seconds
         valid_after = current_time - certificate_validity_before_seconds
+        bypass_time_validity_check = False
 
     # Authenticate the user with KMS, if key is setup
     if config.get(KMSAUTH_SECTION, KMSAUTH_USEKMSAUTH_OPTION):
@@ -164,7 +166,7 @@ def lambda_handler(event, context=None, ca_private_key_password=None,
         time.strftime("%Y/%m/%d %H:%M:%S", time.gmtime(valid_before)))
     cert_builder.set_critical_option_source_address('{},{}'.format(request.bastion_user_ip, request.bastion_ips))
     cert_builder.set_key_id(key_id)
-    cert = cert_builder.get_cert_file()
+    cert = cert_builder.get_cert_file(bypass_time_validity_check)
 
     logger.info(
         'Issued a cert to bastion_ips[{}] for the remote_username of [{}] with the key_id[{}] and '

bless/ssh/certificates/ssh_certificate_builder.py

@@ -195,7 +195,7 @@ def add_extension(self, extension):
 
         self.extensions.add(extension)
 
-    def get_cert_file(self):
+    def get_cert_file(self, bypass_time_validity_check=False):
         """
         Generate the SSH Certificate that can be written to id_rsa-cert.pub or similar file.
 
@@ -206,7 +206,8 @@ def get_cert_file(self):
         """
         file_contents = (
             "{} {} {}"
-        ).format(self.cert_key_type, base64.b64encode(self._sign_cert()),
+        ).format(self.cert_key_type,
+                 base64.b64encode(self._sign_cert(bypass_time_validity_check)),
                  self.public_key_comment)
         return file_contents
 
@@ -238,11 +239,12 @@ def _validate_cert_properties(self):
         if self.valid_after >= self.valid_before:
             raise ValueError("Impossible validity period")
 
-    def _sign_cert(self):
+    def _sign_cert(self, bypass_time_validity_check=False):
         if self.signed_cert is None:
             # build cert body
             self._initialize_unset_attributes()
-            self._validate_cert_properties()
+            if not bypass_time_validity_check:
+                self._validate_cert_properties()
             body_bytes = self._serialize_certificate_body()
 
             # sign the body