diff --git a/ChangeLog b/ChangeLog
index 8c064ad4b..e24494a61 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,7 @@ Changes
      that prevented bignum.c from compiling. (Reported by Rafael Baptista.)
    * Improvements to tests/Makefile, contributed by Oden Eriksson.
    * Use UTC time to check certificate validity.
+   * Reject certificates with times not in UTC, per RFC 5280.
 
 Security
    * Forbid change of server certificate during renegotiation to prevent
diff --git a/library/x509parse.c b/library/x509parse.c
index f3e783152..31699b0e3 100644
--- a/library/x509parse.c
+++ b/library/x509parse.c
@@ -370,7 +370,7 @@ static int x509_get_time( unsigned char **p,
         memcpy( date, *p, ( len < sizeof( date ) - 1 ) ?
                 len : sizeof( date ) - 1 );
 
-        if( sscanf( date, "%2d%2d%2d%2d%2d%2d",
+        if( sscanf( date, "%2d%2d%2d%2d%2d%2dZ",
                     &time->year, &time->mon, &time->day,
                     &time->hour, &time->min, &time->sec ) < 5 )
             return( POLARSSL_ERR_X509_CERT_INVALID_DATE );
@@ -394,7 +394,7 @@ static int x509_get_time( unsigned char **p,
         memcpy( date, *p, ( len < sizeof( date ) - 1 ) ?
                 len : sizeof( date ) - 1 );
 
-        if( sscanf( date, "%4d%2d%2d%2d%2d%2d",
+        if( sscanf( date, "%4d%2d%2d%2d%2d%2dZ",
                     &time->year, &time->mon, &time->day,
                     &time->hour, &time->min, &time->sec ) < 5 )
             return( POLARSSL_ERR_X509_CERT_INVALID_DATE );