From 80ffa728639659c0159e0a26d7e49df9990f761a Mon Sep 17 00:00:00 2001
From: Adnan Maolood <me@adnano.co>
Date: Sat, 19 Dec 2020 13:43:47 -0500
Subject: [PATCH] client: Verify expiration time

---
 client.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/client.go b/client.go
index a0f571a..8c34242 100644
--- a/client.go
+++ b/client.go
@@ -5,6 +5,7 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"errors"
 	"net"
 	"strings"
 	"time"
@@ -106,6 +107,10 @@ func (c *Client) verifyConnection(req *Request, cs tls.ConnectionState) error {
 	if err := verifyHostname(cert, hostname); err != nil {
 		return err
 	}
+	// Check expiration date
+	if !time.Now().Before(cert.NotAfter) {
+		return errors.New("gemini: certificate expired")
+	}
 
 	// See if the client trusts the certificate
 	if c.TrustCertificate != nil {