Index: /trunk/src/VBox/Runtime/common/asn1/asn1-ut-time-decode.cpp
===================================================================
--- /trunk/src/VBox/Runtime/common/asn1/asn1-ut-time-decode.cpp	(revision 75175)
+++ /trunk/src/VBox/Runtime/common/asn1/asn1-ut-time-decode.cpp	(revision 75176)
@@ -57,6 +57,13 @@
         && pThis->Time.u8Hour   <  24
         && pThis->Time.u8Minute <  60
-        && pThis->Time.u8Second <  60) /** @todo what about leap seconds? */
-    {
+        && pThis->Time.u8Second <= 60)
+    {
+        /* Suppress leap seconds and work around clever rounding error in DER_CFDateToUTCTime() on OS X. */
+        if (pThis->Time.u8Second < 60)
+        { /* likely */ }
+        else
+            pThis->Time.u8Second = 59;
+
+        /* Normalize and move on. */
         RTTIME const TimeCopy = pThis->Time;
         if (RTTimeNormalize(&pThis->Time))
@@ -71,6 +78,10 @@
 
             rc = RTAsn1CursorSetInfo(pCursor, VERR_ASN1_TIME_NORMALIZE_MISMATCH,
-                                     "%s: Normalized result not the same as %s: '%.*s'",
-                                     pszErrorTag, pszType, pThis->Asn1Core.cb, pThis->Asn1Core.uData.pch);
+                                     "%s: Normalized result not the same as %s: '%.*s' / %04u-%02u-%02uT%02u:%02u:%02u vs %04u-%02u-%02uT%02u:%02u:%02u",
+                                     pszErrorTag, pszType, pThis->Asn1Core.cb, pThis->Asn1Core.uData.pch,
+                                     TimeCopy.i32Year, TimeCopy.u8Month, TimeCopy.u8MonthDay,
+                                     TimeCopy.u8Hour, TimeCopy.u8Minute, TimeCopy.u8Second,
+                                     pThis->Time.i32Year, pThis->Time.u8Month, pThis->Time.u8MonthDay,
+                                     pThis->Time.u8Hour, pThis->Time.u8Minute, pThis->Time.u8Second);
         }
         else
Index: /trunk/src/VBox/Runtime/tools/RTSignTool.cpp
===================================================================
--- /trunk/src/VBox/Runtime/tools/RTSignTool.cpp	(revision 75175)
+++ /trunk/src/VBox/Runtime/tools/RTSignTool.cpp	(revision 75176)
@@ -1803,6 +1803,14 @@
         /* Signing time (PKCS \#9), use pSigningTime. */
         case RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME:
-            RTPrintf("%sTODO: RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME! %u bytes\n",
-                     pThis->szPrefix, pAttr->uValues.pSigningTime->SetCore.Asn1Core.cb);
+            for (uint32_t i = 0; i < pAttr->uValues.pSigningTime->cItems; i++)
+            {
+                PCRTASN1TIME pTime = pAttr->uValues.pSigningTime->papItems[i];
+                char szTS[RTTIME_STR_LEN];
+                RTTimeToString(&pTime->Time, szTS, sizeof(szTS));
+                if (pAttr->uValues.pSigningTime->cItems == 1)
+                    RTPrintf("%s %s (%.*s)\n", pThis->szPrefix, szTS, pTime->Asn1Core.cb, pTime->Asn1Core.uData.pch);
+                else
+                    RTPrintf("%s #%u: %s (%.*s)\n", pThis->szPrefix, i, szTS, pTime->Asn1Core.cb, pTime->Asn1Core.uData.pch);
+            }
             break;