diff --git a/CHANGES b/CHANGES
index 75ba65656d..df00017d9a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3065.	[bug]		RRSIG could have time stamps too far in the future.
+			[RT #23356]
+
 3064.	[bug]		powerpc: add sync instructions to the end of atomic
 			operations. [RT #23469]
 
diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
index ea2374e4f4..afbc5b7244 100644
--- a/lib/dns/tests/Makefile.in
+++ b/lib/dns/tests/Makefile.in
@@ -12,7 +12,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.2 2011/02/26 02:26:10 each Exp $
+# $Id: Makefile.in,v 1.3 2011/03/09 07:22:31 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -37,10 +37,10 @@ DNSDEPLIBS =	../libdns.@A@
 LIBS =		@LIBS@ @ATFLIBS@
 
 OBJS =		dnstest.@O@
-SRCS =		dnstest.c master_test.c
+SRCS =		dnstest.c master_test.c time_test.c
 
 SUBDIRS =
-TARGETS =	master_test@EXEEXT@
+TARGETS =	master_test@EXEEXT@ time_test@EXEEXT@
 
 @BIND9_MAKE_RULES@
 
@@ -49,5 +49,9 @@ master_test@EXEEXT@: master_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 			master_test.@O@ dnstest.@O@ ${DNSLIBS} \
 				${ISCLIBS} ${LIBS}
 
+time_test@EXEEXT@: time_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
+			time_test.@O@ dnstest.@O@ ${DNSLIBS} \
+				${ISCLIBS} ${LIBS}
 clean distclean::
 	rm -f ${TARGETS}
diff --git a/lib/dns/tests/time_test.c b/lib/dns/tests/time_test.c
new file mode 100644
index 0000000000..c3a7def7bc
--- /dev/null
+++ b/lib/dns/tests/time_test.c
@@ -0,0 +1,218 @@
+/*
+ * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: time_test.c,v 1.2 2011/03/09 07:22:32 marka Exp $ */
+
+/*! \file */
+
+#include <config.h>
+
+#include <atf-c.h>
+
+#include <unistd.h>
+
+#include <dns/time.h>
+
+#include "dnstest.h"
+
+#define TEST_ORIGIN	"test"
+
+/*
+ * Individual unit tests
+ */
+
+/* value = 0xfffffffff <-> 19691231235959 */
+ATF_TC(epoch_minus_one);
+ATF_TC_HEAD(epoch_minus_one, tc) {
+  atf_tc_set_md_var(tc, "descr", "0xffffffff <-> 19691231235959");
+}
+ATF_TC_BODY(epoch_minus_one, tc) {
+	const char *test_text = "19691231235959";
+	const isc_uint32_t test_time = 0xffffffff;
+	isc_result_t result;
+	isc_buffer_t target;
+	isc_uint32_t when;
+	char buf[128];
+
+	UNUSED(tc);
+
+	result = dns_test_begin(NULL);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	memset(buf, 0, sizeof(buf));
+	isc_buffer_init(&target, buf, sizeof(buf));
+	result = dns_time32_totext(test_time, &target);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	ATF_REQUIRE_STREQ(buf, test_text);
+	result = dns_time32_fromtext(test_text, &when);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(when, test_time);
+	dns_test_end();
+}
+
+/* value = 0x000000000 <-> 19700101000000*/
+ATF_TC(epoch);
+ATF_TC_HEAD(epoch, tc) {
+  atf_tc_set_md_var(tc, "descr", "0x00000000 <-> 19700101000000");
+}
+ATF_TC_BODY(epoch, tc) {
+	const char *test_text = "19700101000000";
+	const isc_uint32_t test_time = 0x00000000;
+	isc_result_t result;
+	isc_buffer_t target;
+	isc_uint32_t when;
+	char buf[128];
+
+	UNUSED(tc);
+
+	result = dns_test_begin(NULL);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	memset(buf, 0, sizeof(buf));
+	isc_buffer_init(&target, buf, sizeof(buf));
+	result = dns_time32_totext(test_time, &target);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	ATF_REQUIRE_STREQ(buf, test_text);
+	result = dns_time32_fromtext(test_text, &when);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(when, test_time);
+	dns_test_end();
+}
+
+/* value = 0x7fffffff <-> 20380119031407 */
+ATF_TC(half_maxint);
+ATF_TC_HEAD(half_maxint, tc) {
+  atf_tc_set_md_var(tc, "descr", "0x7fffffff <-> 20380119031407");
+}
+ATF_TC_BODY(half_maxint, tc) {
+	const char *test_text = "20380119031407";
+	const isc_uint32_t test_time = 0x7fffffff;
+	isc_result_t result;
+	isc_buffer_t target;
+	isc_uint32_t when;
+	char buf[128];
+
+	UNUSED(tc);
+
+	result = dns_test_begin(NULL);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	memset(buf, 0, sizeof(buf));
+	isc_buffer_init(&target, buf, sizeof(buf));
+	result = dns_time32_totext(test_time, &target);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	ATF_REQUIRE_STREQ(buf, test_text);
+	result = dns_time32_fromtext(test_text, &when);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(when, test_time);
+	dns_test_end();
+}
+
+/* value = 0x80000000 <-> 20380119031408 */
+ATF_TC(half_plus_one);
+ATF_TC_HEAD(half_plus_one, tc) {
+  atf_tc_set_md_var(tc, "descr", "0x80000000 <-> 20380119031408");
+}
+ATF_TC_BODY(half_plus_one, tc) {
+	const char *test_text = "20380119031408";
+	const isc_uint32_t test_time = 0x80000000;
+	isc_result_t result;
+	isc_buffer_t target;
+	isc_uint32_t when;
+	char buf[128];
+
+	UNUSED(tc);
+
+	result = dns_test_begin(NULL);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	memset(buf, 0, sizeof(buf));
+	isc_buffer_init(&target, buf, sizeof(buf));
+	result = dns_time32_totext(test_time, &target);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	ATF_REQUIRE_STREQ(buf, test_text);
+	result = dns_time32_fromtext(test_text, &when);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(when, test_time);
+	dns_test_end();
+}
+
+/* value = 0xef68f5d0 <-> 19610307130000 */
+ATF_TC(fifty_before);
+ATF_TC_HEAD(fifty_before, tc) {
+  atf_tc_set_md_var(tc, "descr", "0xef68f5d0 <-> 19610307130000");
+}
+ATF_TC_BODY(fifty_before, tc) {
+	isc_result_t result;
+	const char *test_text = "19610307130000";
+	const isc_uint32_t test_time = 0xef68f5d0;
+	isc_buffer_t target;
+	isc_uint32_t when;
+	char buf[128];
+
+	UNUSED(tc);
+
+	result = dns_test_begin(NULL);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	memset(buf, 0, sizeof(buf));
+	isc_buffer_init(&target, buf, sizeof(buf));
+	result = dns_time32_totext(test_time, &target);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	ATF_REQUIRE_STREQ(buf, test_text);
+	result = dns_time32_fromtext(test_text, &when);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(when, test_time);
+	dns_test_end();
+}
+
+/* value = 0x4d74d6d0 <-> 20110307130000 */
+ATF_TC(some_ago);
+ATF_TC_HEAD(some_ago, tc) {
+  atf_tc_set_md_var(tc, "descr", "0x4d74d6d0 <-> 20110307130000");
+}
+ATF_TC_BODY(some_ago, tc) {
+	const char *test_text = "20110307130000";
+	const isc_uint32_t test_time = 0x4d74d6d0;
+	isc_result_t result;
+	isc_buffer_t target;
+	isc_uint32_t when;
+	char buf[128];
+
+	UNUSED(tc);
+
+	result = dns_test_begin(NULL);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	memset(buf, 0, sizeof(buf));
+	isc_buffer_init(&target, buf, sizeof(buf));
+	result = dns_time32_totext(test_time, &target);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	ATF_REQUIRE_STREQ(buf, test_text);
+	result = dns_time32_fromtext(test_text, &when);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	ATF_REQUIRE_EQ(when, test_time);
+	dns_test_end();
+}
+
+/*
+ * Main
+ */
+ATF_TP_ADD_TCS(tp) {
+	ATF_TP_ADD_TC(tp, epoch_minus_one);
+	ATF_TP_ADD_TC(tp, epoch);
+	ATF_TP_ADD_TC(tp, half_maxint);
+	ATF_TP_ADD_TC(tp, half_plus_one);
+	ATF_TP_ADD_TC(tp, fifty_before);
+	ATF_TP_ADD_TC(tp, some_ago);
+
+	return (atf_no_error());
+}
+
diff --git a/lib/dns/time.c b/lib/dns/time.c
index 29a69fe8e5..c99b11fb6c 100644
--- a/lib/dns/time.c
+++ b/lib/dns/time.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: time.c,v 1.35 2010/04/21 23:51:22 tbox Exp $ */
+/* $Id: time.c,v 1.36 2011/03/09 07:22:31 marka Exp $ */
 
 /*! \file */
 
@@ -28,6 +28,7 @@
 
 #include <isc/print.h>
 #include <isc/region.h>
+#include <isc/serial.h>
 #include <isc/stdtime.h>
 #include <isc/util.h>
 
@@ -44,13 +45,21 @@ dns_time64_totext(isc_int64_t t, isc_buffer_t *target) {
 	unsigned int l;
 	isc_region_t region;
 
-	REQUIRE(t >= 0);
-
+/*
+ * Warning. Do NOT use arguments with side effects with these macros.
+ */
 #define is_leap(y) ((((y) % 4) == 0 && ((y) % 100) != 0) || ((y) % 400) == 0)
 #define year_secs(y) ((is_leap(y) ? 366 : 365 ) * 86400)
 #define month_secs(m,y) ((days[m] + ((m == 1 && is_leap(y)) ? 1 : 0 )) * 86400)
 
 	tm.tm_year = 70;
+	while (t < 0) {
+		if (tm.tm_year == 0)
+			return (ISC_R_RANGE);
+		tm.tm_year--;
+		secs = year_secs(tm.tm_year + 1900);
+		t += secs;
+	}
 	while ((secs = year_secs(tm.tm_year + 1900)) <= t) {
 		t -= secs;
 		tm.tm_year++;
@@ -98,7 +107,6 @@ isc_result_t
 dns_time32_totext(isc_uint32_t value, isc_buffer_t *target) {
 	isc_stdtime_t now;
 	isc_int64_t start;
-	isc_int64_t base;
 	isc_int64_t t;
 
 	/*
@@ -109,12 +117,10 @@ dns_time32_totext(isc_uint32_t value, isc_buffer_t *target) {
 	 */
 	isc_stdtime_get(&now);
 	start = (isc_int64_t) now;
-	start -= 0x7fffffff;
-	base = 0;
-	while ((t = (base + value)) < start) {
-		base += 0x80000000;
-		base += 0x80000000;
-	}
+	if (isc_serial_gt(value, now))
+		t = start + (value - now);
+	else
+		t = start - (now - value);
 	return (dns_time64_totext(t, target));
 }
 
@@ -145,7 +151,7 @@ dns_time64_fromtext(const char *source, isc_int64_t *target) {
 		   &year, &month, &day, &hour, &minute, &second) != 6)
 		return (DNS_R_SYNTAX);
 
-	RANGE(1970, 9999, year);
+	RANGE(0, 9999, year);
 	RANGE(1, 12, month);
 	RANGE(1, days[month - 1] +
 		 ((month == 2 && is_leap(year)) ? 1 : 0), day);
@@ -154,16 +160,24 @@ dns_time64_fromtext(const char *source, isc_int64_t *target) {
 	RANGE(0, 60, second);		/* 60 == leap second. */
 
 	/*
-	 * Calculate seconds since epoch.
+	 * Calculate seconds from epoch.
+	 * Note: this uses a idealized calendar.
 	 */
 	value = second + (60 * minute) + (3600 * hour) + ((day - 1) * 86400);
 	for (i = 0; i < (month - 1); i++)
 		value += days[i] * 86400;
 	if (is_leap(year) && month > 2)
 		value += 86400;
-	for (i = 1970; i < year; i++) {
-		secs = (is_leap(i) ? 366 : 365) * 86400;
-		value += secs;
+	if (year < 1970) {
+		for (i = 1969; i >= year; i--) {
+			secs = (is_leap(i) ? 366 : 365) * 86400;
+			value -= secs;
+		}
+	} else {
+		for (i = 1970; i < year; i++) {
+			secs = (is_leap(i) ? 366 : 365) * 86400;
+			value += secs;
+		}
 	}
 
 	*target = value;