Make DKDMs with validity 2 minutes shorter than the signer certificate

validity (#1728).

diff --git a/src/tools/dcpomatic.cc b/src/tools/dcpomatic.cc
index 47851a21874249f67244ed168259c2c47d9ddbb6..ea3cfbe32c7697665208917074d1365285e5c57a 100644 (file)
--- a/src/tools/dcpomatic.cc
+++ b/src/tools/dcpomatic.cc
@@ -879,10 +879,10 @@ private:
                        );
 
 
-               dcp::LocalTime from (Config::instance()->decryption_chain()->leaf().not_before());
-               from.add_months (1);
-               dcp::LocalTime to (Config::instance()->decryption_chain()->leaf().not_after());
-               to.add_months (-1);
+               dcp::LocalTime from (Config::instance()->signer_chain()->leaf().not_before());
+               from.add_minutes (1);
+               dcp::LocalTime to (Config::instance()->signer_chain()->leaf().not_after());
+               to.add_minutes (-1);
 
                optional<dcp::EncryptedKDM> kdm;
                try {