Actually use the set security mode

src/AP_WS_Connection.cpp

@@ -4,6 +4,8 @@
 
 
 #include <Poco/Base64Decoder.h>
+#include <Poco/DateTimeFormat.h>
+#include <Poco/DateTimeFormatter.h>
 #include <Poco/Net/Context.h>
 #include <Poco/Net/HTTPServerRequestImpl.h>
 #include <Poco/Net/HTTPServerResponseImpl.h>
@@ -216,6 +218,8 @@ namespace OpenWifi {
 
 			State_.certificateExpiryDate = PeerCert.expiresOn().timestamp().epochTime();
 			State_.certificateIssuerName = PeerCert.issuerName();
+			CertificateValidFrom_ = Poco::DateTimeFormatter::format(PeerCert.validFrom(), Poco::DateTimeFormat::HTTP_FORMAT);
+			CertificateValidTo_ = Poco::DateTimeFormatter::format(PeerCert.expiresOn(), Poco::DateTimeFormat::HTTP_FORMAT);
 
 			poco_trace(Logger_,
 					   fmt::format("TLS-CONNECTION({}): Session={} CN={} Completed. (t={})", CId_,

src/AP_WS_Connection.h

@@ -145,6 +145,8 @@ namespace OpenWifi {
 		std::double_t 	memory_used_=0.0, cpu_load_ = 0.0, temperature_ = 0.0;
 		std::uint64_t 	uuid_=0;
 		bool	Simulated_=false;
+		std::string CertificateValidFrom_;
+		std::string CertificateValidTo_;
 		std::atomic_uint64_t 	LastContact_=0;
 		Poco::Buffer<char> IncomingFrame_;
 

src/AP_WS_Process_connect.cpp

@@ -259,6 +259,9 @@ namespace OpenWifi {
 												 "device. Session={} ConnectionCompletion Time={}",
 												 CId_, State_.sessionId,
 												 State_.connectionCompletionTime));
+					poco_information(Logger_,
+									 fmt::format("CONNECT({}): Certificate validity: NotBefore={} NotAfter={}",
+												 CId_, CertificateValidFrom_, CertificateValidTo_));
 				} else {
 					State_.VerifiedCertificate = GWObjects::MISMATCH_SERIAL;
 					if (AP_WS_Server()->AllowSerialNumberMismatch()) {
@@ -268,6 +271,10 @@ namespace OpenWifi {
 										"Serial={} Session={} ConnectionCompletion Time={}",
 										CId_, CN_, SerialNumber_, State_.sessionId,
 										State_.connectionCompletionTime));
+						poco_information(
+							Logger_,
+							fmt::format("CONNECT({}): Certificate validity: NotBefore={} NotAfter={}",
+										CId_, CertificateValidFrom_, CertificateValidTo_));
 					} else {
 						poco_information(
 							Logger_, fmt::format("CONNECT({}): Serial number mismatch disallowed. "

src/AP_WS_Server.cpp

@@ -6,6 +6,7 @@
 //	Arilia Wireless Inc.
 //
 
+#include <Poco/Net/AcceptCertificateHandler.h>
 #include <Poco/Net/Context.h>
 #include <Poco/Net/HTTPHeaderStream.h>
 #include <Poco/Net/HTTPServerRequest.h>
@@ -116,7 +117,11 @@ namespace OpenWifi {
 
 			Poco::Net::Context::Params P;
 
-			P.verificationMode = Poco::Net::Context::VERIFY_ONCE;
+			// If VERIFY_NONE is configured, use VERIFY_RELAXED instead so we still
+			// request client certificates (needed to extract device serial from CN),
+			// but add AcceptCertificateHandler to ignore validation errors like expiration
+			bool acceptAllCerts = (Svr.Level() == Poco::Net::Context::VERIFY_NONE);
+			P.verificationMode = acceptAllCerts ? Poco::Net::Context::VERIFY_RELAXED : Svr.Level();
 			P.verificationDepth = 9;
 			P.loadDefaultCAs = Svr.RootCA().empty();
 			P.cipherList = "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH";
@@ -125,6 +130,12 @@ namespace OpenWifi {
 			auto Context = Poco::AutoPtr<Poco::Net::Context>(
 				new Poco::Net::Context(Poco::Net::Context::TLS_SERVER_USE, P));
 
+			if (acceptAllCerts) {
+				Context->setInvalidCertificateHandler(
+					Poco::SharedPtr<Poco::Net::InvalidCertificateHandler>(
+						new Poco::Net::AcceptCertificateHandler(true)));
+			}
+
 			Poco::Crypto::X509Certificate Cert(Svr.CertFile());
 			Poco::Crypto::X509Certificate Root(Svr.RootCA());
 

src/framework/SubSystemServer.h

@@ -51,6 +51,7 @@ namespace OpenWifi {
 		[[nodiscard]] inline auto Name() const { return name_; };
 		[[nodiscard]] inline int Backlog() const { return backlog_; }
 		[[nodiscard]] inline auto Cas() const { return cas_; }
+		[[nodiscard]] inline auto Level() const { return level_; }
 
 		[[nodiscard]] Poco::Net::SecureServerSocket CreateSecureSocket(Poco::Logger &L) const;
 		[[nodiscard]] Poco::Net::ServerSocket CreateSocket([[maybe_unused]] Poco::Logger &L) const;