certtoolで作る自己認証局署名の証明書の期限の限界は9999年だった

# cd hoge

# openssl genrsa -des3 -out ./ca.key 2048 -config /etc/pki/tls/openssl-ca.cnf 
Enter pass phrase for ./ca.key:*****
# openssl req -new -x509 -days 3650 -sha256 -key ./ca.key -out ./ca.crt -config /etc/pki/tls/openssl-ca.cnf
Enter pass phrase for ./ca.key:*****
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [JP]:
State or Province Name (full name) [Tokyo]:
Locality Name (eg, city) [****bashi]:
Organization Name (eg, company) [****Corporation]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:

# openssl x509 -inform pem -in ./ca.crt -outform der -out ./ca.der
# cp ca.key /etc/pki/CA/private/
# cp ca.crt /etc/pki/CA/
# cp ca.crt /usr/share/pki/ca-trust-source/anchors/
# update-ca-trust extract
# touch /etc/pki/CA/index.txt
# echo 01 > /etc/pki/CA/serial

# openssl ca -in ../server.csr -keyfile /etc/pki/CA/private/ca.key -cert /etc/pki/CA/ca.crt -startdate 161228000000Z -enddate 491231235959Z -out server.crt -config /etc/pki/tls/openssl-server.cnf
～略～
            Not Before: Dec 28 00:00:00 2016 GMT
            Not After : Dec 31 23:59:59 2049 GMT
～略～

# yum install gnutls-utils
# rpm -qa|grep gnutls
gnutls-utils-3.3.24-1.el7.x86_64
gnutls-dane-3.3.24-1.el7.x86_64
gnutls-3.3.24-1.el7.x86_64
# rpm -ql gnutls-utils-3.3.24-1.el7.x86_64
～略～
/usr/share/doc/gnutls-utils-3.3.24/certtool.cfg

# cp -p /usr/share/doc/gnutls-utils-3.3.24/certtool.cfg .
# diff /usr/share/doc/gnutls-utils-3.3.24/certtool.cfg certtool.cfg
～略～
65,66c65,66
< #activation_date = "2004-02-29 16:21:42"
< #expiration_date = "2025-02-29 16:24:41"
---
> activation_date = "2016-12-28 00:00:00"
> expiration_date = "9999-12-31 23:59:59"
～略～

# certtool --generate-certificate --load-request server.csr \
   --outfile server.crt --load-ca-certificate /etc/pki/CA/ca.crt \
   --load-ca-privkey /etc/pki/CA/private/ca.key --template certtool.cfg
～略～
        Validity:
                Not Before: Tue Dec 27 15:00:00 UTC 2016
                Not After: Fri Dec 31 23:59:59 UTC 9999
～略～

# openssl x509 -text -noout -in server.crt |grep -A 3 Validity
        Validity
            Not Before: Dec 27 15:00:00 2016 GMT
            Not After : Dec 31 23:59:59 9999 GMT
        Subject: C=JP, ST=Tokyo, L=****bashi, O=****Corporation, OU=****, CN=*.hoge.net