diff -ur mbedtls-1.3.17/library/x509.c polarssl.new/library/x509.c
--- mbedtls-1.3.17/library/x509.c	2016-06-27 13:00:26.000000000 -0600
+++ polarssl.new/library/x509.c	2016-08-04 17:21:52.000000000 -0600
@@ -490,6 +490,73 @@
 }
 
 /*
+ * Parse an ASN1_UTC_TIME (yearlen=2) or ASN1_GENERALIZED_TIME (yearlen=4) field.
+ */
+static int x509_parse_time(unsigned char **p, size_t len, unsigned int yearlen, x509_time *time)
+{
+  int ret;
+
+  /* minimum length is 10 or 12 depending on yearlen */
+  if (len < yearlen + 8)
+    return POLARSSL_ERR_X509_INVALID_DATE;
+  len -= yearlen + 8;
+
+  /* parse year, month, day, hour, minute */
+  CHECK( x509_parse_int( p, yearlen, &time->year ) );
+  if (yearlen == 2)
+    {
+      if (time->year < 50)
+	time->year += 100;
+      time->year += 1900;
+    }
+  CHECK( x509_parse_int( p, 2, &time->mon ) );
+  CHECK( x509_parse_int( p, 2, &time->day ) );
+  CHECK( x509_parse_int( p, 2, &time->hour ) );
+  CHECK( x509_parse_int( p, 2, &time->min ) );
+
+  /* parse seconds if present */
+  if (len >= 2 && **p >= '0' && **p <= '9')
+    {
+      CHECK( x509_parse_int( p, 2, &time->sec ) );
+      len -= 2;
+    }
+  else
+    {
+#if defined(POLARSSL_RELAXED_X509_DATE)
+      /* if relaxed mode, allow seconds to be absent */
+      time->sec = 0;
+#else
+      return POLARSSL_ERR_X509_INVALID_DATE;
+#endif
+    }
+
+  /* parse trailing 'Z' if present */
+  if (len == 1 && **p == 'Z')
+    {
+      (*p)++;
+      return 0;
+    }
+
+#if defined(POLARSSL_RELAXED_X509_DATE)
+  /* if relaxed mode, allow timezone to be present */
+  else if (len == 5 && **p == '+')
+    {
+      int tz; /* throwaway timezone */
+      (*p)++;
+      CHECK( x509_parse_int( p, 4, &tz ) );
+      return 0;
+    }
+#endif
+
+  /* okay if no trailing 'Z' or timezone specified */
+  else if (len == 0)
+    return 0;
+
+  else
+    return POLARSSL_ERR_X509_INVALID_DATE;
+}
+
+/*
  *  Time ::= CHOICE {
  *       utcTime        UTCTime,
  *       generalTime    GeneralizedTime }
@@ -515,20 +582,7 @@
         if( ret != 0 )
             return( POLARSSL_ERR_X509_INVALID_DATE + ret );
 
-        CHECK( x509_parse_int( p, 2, &time->year ) );
-        CHECK( x509_parse_int( p, 2, &time->mon ) );
-        CHECK( x509_parse_int( p, 2, &time->day ) );
-        CHECK( x509_parse_int( p, 2, &time->hour ) );
-        CHECK( x509_parse_int( p, 2, &time->min ) );
-        if( len > 10 )
-            CHECK( x509_parse_int( p, 2, &time->sec ) );
-        if( len > 12 && *(*p)++ != 'Z' )
-            return( POLARSSL_ERR_X509_INVALID_DATE );
-
-        time->year +=  100 * ( time->year < 50 );
-        time->year += 1900;
-
-        return( 0 );
+        return x509_parse_time(p, len, 2, time);
     }
     else if( tag == ASN1_GENERALIZED_TIME )
     {
@@ -538,17 +592,7 @@
         if( ret != 0 )
             return( POLARSSL_ERR_X509_INVALID_DATE + ret );
 
-        CHECK( x509_parse_int( p, 4, &time->year ) );
-        CHECK( x509_parse_int( p, 2, &time->mon ) );
-        CHECK( x509_parse_int( p, 2, &time->day ) );
-        CHECK( x509_parse_int( p, 2, &time->hour ) );
-        CHECK( x509_parse_int( p, 2, &time->min ) );
-        if( len > 12 )
-            CHECK( x509_parse_int( p, 2, &time->sec ) );
-        if( len > 14 && *(*p)++ != 'Z' )
-            return( POLARSSL_ERR_X509_INVALID_DATE );
-
-        return( 0 );
+        return x509_parse_time(p, len, 4, time);
     }
     else
         return( POLARSSL_ERR_X509_INVALID_DATE +