cert: fix expiry for non-UTC time zones

cert/cert.go

 package cert
 
 import (
         "crypto/rand"
         "crypto/rsa"
         "crypto/sha1"
         "crypto/tls"
         "crypto/x509"
         "crypto/x509/pkix"
         "encoding/pem"
@@ skipping 73 matching lines @@
         now := time.Now()
         template := &x509.Certificate{
                 SerialNumber: new(big.Int),
                 Subject: pkix.Name{
                         // TODO quote the environment name when we start using
                         // Go version 1.1. See Go issue 3791.
                         CommonName:   fmt.Sprintf("juju-generated CA for environment %s", envName),
                         Organization: []string{"juju"},
                 },
                 NotBefore:             now.UTC().Add(-5 * time.Minute),
-                NotAfter:              expiry,
+                NotAfter:              expiry.UTC(),
                 SubjectKeyId:          bigIntHash(key.N),
                 KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
                 BasicConstraintsValid: true,
                 IsCA:                  true,
                 MaxPathLen:            0, // Disallow delegation for now.
         }
         certDER, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
         if err != nil {
                 return nil, nil, fmt.Errorf("canot create certificate: %v", err)
         }
@@ skipping 36 matching lines @@
         now := time.Now()
         template := &x509.Certificate{
                 SerialNumber: new(big.Int),
                 Subject: pkix.Name{
                         // This won't match host names with dots. The hostname
                         // is hardcoded when connecting to avoid the issue.
                         CommonName:   "*",
                         Organization: []string{"juju"},
                 },
                 NotBefore: now.UTC().Add(-5 * time.Minute),
-                NotAfter:  expiry,
+                NotAfter:  expiry.UTC(),
 
                 SubjectKeyId: bigIntHash(key.N),
                 KeyUsage:     x509.KeyUsageDataEncipherment,
         }
         certDER, err := x509.CreateCertificate(rand.Reader, template, caCert, &key.PublicKey, caKey)
         if err != nil {
                 return nil, nil, err
         }
         certPEM = pem.EncodeToMemory(&pem.Block{
                 Type:  "CERTIFICATE",
                 Bytes: certDER,
         })
         keyPEM = pem.EncodeToMemory(&pem.Block{
                 Type:  "RSA PRIVATE KEY",
                 Bytes: x509.MarshalPKCS1PrivateKey(key),
         })
         return certPEM, keyPEM, nil
 }
 
 func bigIntHash(n *big.Int) []byte {
         h := sha1.New()
         h.Write(n.Bytes())
         return h.Sum(nil)
 }