Support an explicit verification time for registration attestation certificates

[rdeelstra]

Request

Could @simplewebauthn/server expose an optional now/at verification time on verifyRegistrationResponse, or a supported way to inject the time used by validateCertificatePath?

We re-verify stored registrations against a pinned metadata statement at their recorded registration time. In 13.3.3, local checks at that recorded time are followed by upstream certificate-validity checks at the current run time. This is an accepted limitation in our integration, and we are keeping the current dependency pin.

The requested time seam would need to cover every x5c certificate and the metadata statement's trust anchors across packed, tpm and android-key, including any format-specific certificate-date check. Injecting time only at the leaf would leave the chain and root checks on a different clock.

Desired behavior

Keep the existing current-time default. When a caller explicitly supplies a verification time, use that time consistently for certificate validity while retaining the ceremony, signature, chain, metadata and other non-time checks. Please clarify whether revocation and metadata freshness should stay on the current clock or require a separate policy; this request does not propose changing those defaults implicitly.

The current certificate-path helper also reads the current clock: validateCertificatePath.ts. If there is already a supported API for this use case, a pointer would help. No dependency pin change is part of this request.

[MasterKale]

Hey @rdeelstra, thanks for describing your use case:

We re-verify stored registrations against a pinned metadata statement at their recorded registration time

Is this some kind of batch operation you periodically run? When I read the pain point you're describing it made me wonder if you couldn't follow the pattern I use in unit tests to set the time that the tests execute in, to avoid problems with various certificates becoming test data and then becoming temporally invalid when the tests run in the future after the certificates' notAfter.

For an example of what I'm talking about, take a look at this unit test for validateCertificatePath():

SimpleWebAuthn/packages/server/src/helpers/validateCertificatePath.test.ts

Lines 141 to 163 in 787ca82

	Deno.test('should raise on expired leaf certificate', async () => {
	using _fakedNow = new FakeTime(new Date('2026-06-08'));
	const notBefore = new Date('2026-06-07');
	const notAfter = new Date('2026-06-09');
	const rootCert = await generateRootCert({ notBefore, notAfter });
	const leafCert = await generateLeafCert({
	notBefore,
	notAfter: new Date('2026-06-07'), // <-- earlier than _fakedNow
	issuer: rootCert,
	});
	await assertRejects(
	() =>
	validateCertificatePath(
	[leafCert.certificate.toString()],
	[rootCert.certificate.toString()],
	),
	SimpleWebAuthnError,
	'certificate out of validity period',
	);
	});

Would a pattern like this work as a solution for your use case?

[MasterKale]

I'm using Deno's @std/testing/time, hosted on JSR.io, in these tests, but I know for a fact there are many packages hosted on NPM that can do similar things of manipulating the runtime timer to lock it down for time-sensitive work like this. I've been using Deno for this project for so long I forgot which one I used to use before 😅