The allocation failure was reported on the output BIO and then skipped
the certificate, so the command exited with status zero without having
checked anything. Report it on stderr and reach err: like every other
failure path, as deferred by commit 8da3880874 "apps/x509.c: failing
exit status on every failure path reaching err:".
Fixes: 4036f4b0e3 "Add new public API for checking certificate times."
Complements: 8da3880874 "apps/x509.c: failing exit status on every failure path reaching err:"
Assisted-by: Claude:claude-fable-5-1
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Merge-date: Tue Oct 27 17:10:46 2026
Merged-from: https://github.com/openssl/openssl/pull/33104
When the notBefore or notAfter field of a certificate cannot be parsed,
X509_check_certificate_times() fails with an error other than
X509_V_ERR_CERT_HAS_EXPIRED. The -checkend handling only reacted
to that one error, so a certificate with a corrupt validity period
printed nothing and exited with status zero, i.e. was treated
as not expiring. The same silent success happened for a certificate
that is not yet valid at the check time.
Report an unparsable validity period as an error with a failing exit
status. Report a certificate that only becomes valid after the check
time as not expiring, which is what -checkend did before the switch
to X509_check_certificate_times(), as it cannot expire
before it is valid.
Add regression tests with corrupted notBefore and notAfter fields,
including with -multi, and with a not yet valid certificate.
Document the behaviour.
Resolves: https://github.com/openssl/openssl/issues/11772
Assisted-by: Claude:claude-fable-5-1
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Merge-date: Tue Oct 27 16:19:04 2026
Merged-from: https://github.com/openssl/openssl/pull/33105
The issuer and the serialNumber are independently OPTIONAL
in a CertTemplate. A component absent from the request cannot confirm
a match with the reference cert, and ASN1_INTEGER_cmp() does not accept
NULL, so require each component the reference cert has to be present
in the request and to be equal.
Fixes: 66be663b64 "cmp_mock_srv.c: Add missing OldCertID check for 'kur' cert update requests"
References: b971d4198d "CMP mock server: add -ref_cert option and corresponding ossl_cmp_mock_srv_set1_refCert()"
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Merge-date: Sat Oct 24 09:44:19 2026
Merged-from: https://github.com/openssl/openssl/pull/33071
When loading ECH keys from a directory (-ech_dir or -ech_noretry_dir),
ech_load_dir() allocated a BIO via BIO_new_file(), but only freed it
on the success path. If a file was readable,
yet OSSL_ECHSTORE_read_pem() failed, the continue skipped
BIO_free_all(), leaking the BIO.
OSSL_ECHSTORE_read_pem() does not take ownership of the caller-supplied
BIO. It pushes and pops its own internal buffer BIO, so the caller
remains responsible for freeing the file BIO in all cases.
Fix this by making the BIO local to each loop iteration and freeing
it in the failure branch as well as the success branch.
This also avoids carrying a dangling BIO pointer from one loop iteration
to the next.
Verified with Valgrind against a directory containing invalid ECH PEM
files: definitely lost: 0 bytes, previously leaked 128 bytes per failing
file.
Resolves: https://github.com/openssl/openssl/issues/31770
Fixes: a2e5848d9d "s_client and s_server options for ECH"
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Merge-date: Fri Oct 9 19:55:28 2026
Merged-from: https://github.com/openssl/openssl/pull/31790
s_server only installed the DTLS and stateless cookie callbacks on its
main SSL_CTX. When -servername matched, the connection was switched to
the second context before the cookie was generated, so a DTLS 1.2
client sending that name failed the handshake with a cookie generation
callback failure instead of getting a HelloVerifyRequest.
Install the callbacks on the SNI context as well and cover the case
with a (D)TLSv1.2 server name handshake in the TLSProxy message test.
Assisted-by: Claude:claude-fable-5-1
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Merge-date: Tue Oct 6 14:46:55 2026
Merged-from: https://github.com/openssl/openssl/pull/33093
The documentation says "If neither of the options are given, an attempt
is made to open the default configuration file [..] If the unnamed
section [..] of the file does not list an B<extensions> variable,
no extensions are added"; however, an attempt was made to load
extensions in that case. Avoid that by using non-NULL extsect
as a guard for do_EXT_REQ_add_nconf() and do_EXT_REQ_add_nconf() calls
(which also avoids passing NULL as an "%s" format qualifier argument
to BIO_printf() calls in case of load failure).
Fixes: 84419e373a "Improved handling of AKID/SKID extensions in CSRs and certs"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Merge-date: Mon Oct 5 10:09:56 2026
Merged-from: https://github.com/openssl/openssl/pull/33083
The signing-only option validation runs before load_key(), so
privkey is always NULL when determining newout. Consequently, -key
or -signkey alone does not identify re-signing an input certificate
or signing an -x509toreq output. Signing options are rejected, and
the default extensions section is not loaded.
Check privkeyfile at this stage, which records that the option was
supplied. Keep the later privkey check unchanged because the key has
been loaded by then. Add tests for the validation guard, re-signing
options, and certificate and request extensions.
Fixes#32150
Assisted-by: pi:kimi-k3
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Merge-date: Fri Sep 25 11:07:32 2026
Merged-from: https://github.com/openssl/openssl/pull/32151
The dsa app set ret to 0 before printing the option parsing error,
resulting in a successful exit status for invalid options. All other
apps keep the initial error status in this case, so drop the errant
assignment to make dsa fail as expected.
Assisted-by: Claude:claude-fable-5
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Merge-date: Wed Sep 16 08:48:56 2026
Merged-from: https://github.com/openssl/openssl/pull/32590
Previously a negative or zero numbits argument made genrsa exit
with a failure status without printing any error message.
Assisted-by: Claude:claude-fable-5
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Merge-date: Mon Sep 7 14:15:50 2026
Merged-from: https://github.com/openssl/openssl/pull/32592
With -multi, a later certificate failure could return success after an
earlier certificate succeeded because ret retained the earlier result
on reaching err:.
Set ret = 1 at err: so every path reaching it reports failure. Paths
bypassing err: remain unchanged, including the pre-existing
X509_VERIFY_PARAM_new() failure under -checkend, which will be addressed
separately.
Add a regression test using -multi -checkhost with a two-certificate
chain whose second certificate fails.
Fixes#32189
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Reviewed-by: Todd Short <todd.short@me.com>
Merge-date: Mon Sep 7 14:01:00 2026
Merged-from: https://github.com/openssl/openssl/pull/32190
get_dp_url() returned the internal ASN1_STRING data of a DIST_POINT URI
directly. That data has an explicit length and is not necessarily NUL
terminated, yet load_crl() and the HTTP client it hands the URI to consume
it as a C string, reading past the buffer for a certificate carrying a
primitive-form IA5String URI in its CRL distribution points.
Return an allocated NUL terminated copy of the URI and free it in
load_crl_crldp().
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Merge-date: Thu Aug 27 13:52:39 2026
Merged-from: https://github.com/openssl/openssl/pull/32178
When verifying CMS messages with multiple signatures using
CMS_VERIFY_PARTIAL to implement additional custom requirements
regarding signatures from which certificates are required and/or
acceptable, information on which signature was considered invalid and
why by CMS_verify is useful for reporting or debugging.
Implement this by adding CMS_SignerInfo-based access to certificates
(CMS_SignerInfo_get0_signer_cert) and verification results
(CMS_SignerInfo_get_verification_result). Also use these new functions
to show more details when using 'openssl cms -verify' with
'-verify_partial'.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Merge-date: Thu Aug 27 13:14:14 2026
Merged-from: https://github.com/openssl/openssl/pull/27604
Currently, OpenSSL supports creating CMS SignedData structures with
multiple signers using CMS_sign() with the CMS_PARTIAL flag combined
with CMS_add1_signer(). This can be done for a new SignedData or by
adding signers to an existing structure. In addition to the C API, this
is supported via openssl cms -sign (using multiple -signer options) and
openssl cms -resign.
The corresponding CMS_verify() function and openssl cms -verify command
check the signatures sequentially and abort with an error on the first
problem. They support some flags (CMS_NO_SIGNER_CERT_VERIFY,
CMS_NO_ATTR_VERIFY, CMS_NO_CONTENT_VERIFY), which disable some aspects
of the verification, but do not allow continuing after a failed
signature verification.
The main use cases for multiple signatures on one message are:
* Simplify CA certificate roll-over by signing messages with keys in
both the old and new hierarchies during a transition period.
Recipients would have either the old or new CA installed (or
temporarily even both). In all cases, we'd like to accept any message
which as at least one signature that can be verified.
* Support user-implemented verification policies which require
signatures from multiple specific signers.
* Support user-implemented verification policies which require a minimum
number of signatures from different signers under under a trusted CA.
This is made possible by adding a CMS_VERIFY_PARTIAL flag to CMS_verify()
and exposing it through a new -verify_partial option to 'openssl cms
-verify'.
If this flag is set, the call is successful even if some of the
individual signatures cannot be verified (perhaps due to CAs missing
from the local store or expired certificates). The application would
then call CMS_get0_signers() and check if the set of valid signatures
satisfies its policy.
Fixes#3028Fixes#26382
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Merge-date: Thu Aug 27 13:14:13 2026
Merged-from: https://github.com/openssl/openssl/pull/27604
This restructureis the apps/lib/apps.c file-rotation helpers
to use snprintf for truncation detection, since they now can.
This also collapses the per-snprintf VMS ifdef into one
SUFFIX_SEP macro because the ifdef-per-call shape was making my eyes
bleed from all the copypasta'ed snprintf lines with only one character
changed in the format string.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Wed Aug 26 16:20:32 2026
(Merged from https://github.com/openssl/openssl/pull/31640)
This used to be necessary because BIO_snprintf() could not detect truncation
but now this is silly, and this ends up tripping GCC's -Wformat-truncation
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Wed Aug 26 16:20:30 2026
(Merged from https://github.com/openssl/openssl/pull/31640)
These sites used the return value to detect truncation, then used the
buffer as is. Convert them to detect truncation in the standard
snprintf() way.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Wed Aug 26 16:20:13 2026
(Merged from https://github.com/openssl/openssl/pull/31640)
under snprintf semantics.
These call sites already guarded the result with the C99 truncation
idiom, so they can simply use snprintf as a replacement as is.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Wed Aug 26 16:20:09 2026
(Merged from https://github.com/openssl/openssl/pull/31640)
Where the return value is discarded, BIO_snprintf() and snprintf() are
interchangeable: both write the same bytes and NUL-terminate the buffer.
The conversion is mechanical.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Wed Aug 26 16:20:07 2026
(Merged from https://github.com/openssl/openssl/pull/31640)
Apparently it is desired to keep this on life support.
So we add a build target for this non-C99 platform, and
provide internal versions of snprintf and vsnprintf for use
only on this platform that match the C99 semantics.
This allows us to use C99 semantics normally elsewhere.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
MergeDate: Wed Aug 26 16:20:04 2026
(Merged from https://github.com/openssl/openssl/pull/31640)
When establishing a terminal socket on OpenVMS, if the async I/O
read operation (sys$qio) fails, the error path returns early without
freeing the allocated channel via sys$dassgn.
Add sys$dassgn(TerminalDeviceChan) in the sys$qio error path during
creation. Also ensure dassgn executes regardless of whether sys$cancel
succeeds during deletion to avoid exhausting the I/O channel quota.
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Merge-date: Wed Aug 19 15:37:03 2026
Merged-from: https://github.com/openssl/openssl/pull/30375
And as a result in this loop. I changed this to a size_t
which was needed where the variable was used later on and
missed this case at the start.
While harmless, coverity notices. so let's do it right
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Merge-date: Fri Aug 14 06:29:29 2026
Merged-from: https://github.com/openssl/openssl/pull/32310
To comply with the naming guidelines for the API functions that transfer
ownership of the data. The majority of the changes was done by
for i in `git grep -l ASN1_STRING_set_data`; do \
sed -i 's/ASN1_STRING_set_data/ASN1_STRING_set1_data/g' "$i"; \
done
for i in `git grep -l ASN1_STRING_set_string`; do \
sed -i 's/ASN1_STRING_set_string/ASN1_STRING_set1_string/g' "$i"; \
done
with a manual touch-up in util/libcrypto.num.
Complements: 28179061bf "Prepare a now opaque ASN1_STRING for the size_t rapture."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
MergeDate: Tue Aug 11 13:56:44 2026
(Merged from https://github.com/openssl/openssl/pull/32015)
To make it in line with ASN1_BIT_STRING_get_length() and other (size)
getters. The majority of the changes was done by
for i in `git grep -l ASN1_STRING_length_ex`; do \
sed -i 's/ASN1_STRING_length_ex/ASN1_STRING_get_length/g' "$i"; \
done
with a manual touch-up in util/libcrypto.num.
Complements: 28179061bf "Prepare a now opaque ASN1_STRING for the size_t rapture."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
MergeDate: Tue Aug 11 13:56:42 2026
(Merged from https://github.com/openssl/openssl/pull/32015)
Add a progress() helper to centralise verbose output. Move usage()
to the top. Rename @old_argv to @saved_argv. Replace foreach with
for+lexical variable. Inline $output_base. Switch exists to defined
for option checks. Remove the main-program comment block.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Shreenidhi Shedi <yesshedi@gmail.com>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Aug 7 13:29:39 2026
(Merged from https://github.com/openssl/openssl/pull/31445)
Switch bareword INPUT filehandle to a lexical filehandle with
three-argument open. Add binmode on both the STDIN and file paths
so timestamp request data is read as raw bytes on all platforms.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Shreenidhi Shedi <yesshedi@gmail.com>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Aug 7 13:29:38 2026
(Merged from https://github.com/openssl/openssl/pull/31445)
Add "use warnings" and wrap CURLOPT_RANDOM_FILE and CURLOPT_EGDSOCKET
setopt calls in eval blocks, as these constants were removed from
libcurl and would cause an exception on modern installations.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Shreenidhi Shedi <yesshedi@gmail.com>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Aug 7 13:29:37 2026
(Merged from https://github.com/openssl/openssl/pull/31445)
Switch from the UPLOAD+CUSTOMREQUEST+read-callback approach to
POSTFIELDS, eliminating the read_body/write_body callbacks and the
INFILE/INFILESIZE/FILE options. Rename get_timestamp to send_request
with a simpler interface that writes directly to the output file via
CURLOPT_WRITEDATA.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Shreenidhi Shedi <yesshedi@gmail.com>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Aug 7 13:29:36 2026
(Merged from https://github.com/openssl/openssl/pull/31445)
Minimal module swap: replace WWW::Curl::Easy with Net::Curl::Easy.
Update callback signatures (Net::Curl passes the easy handle as the
first argument), replace error-code-based perform() with eval/die,
and drop cleanup() which Net::Curl does not require.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Shreenidhi Shedi <yesshedi@gmail.com>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Fri Aug 7 13:29:35 2026
(Merged from https://github.com/openssl/openssl/pull/31445)
Despite the -quiet option s_client still reports the host it connects to
and the certificate chain. Since -quiet is documented as "No s_client
output", hide all non-error output.
Pass the quiet option to init_client() to suppress the host output.
Set verify's quiet flag if quiet is passed.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jul 30 09:09:35 2026
(Merged from https://github.com/openssl/openssl/pull/30519)
Remove the remaining direct atoi()/atol() uses across apps, libcrypto,
libssl, providers, demos and tests, and route the replacements through
checked helpers instead of open-coding the conversion at each call site:
- apps use the existing opt_int()/opt_long()/opt_int_arg() parsers;
- libcrypto and provider code use the new internal ossl_strtol()/
ossl_strtoint() helpers, a checked (and, for ossl_strtoint(),
narrowing) signed counterpart to the public OPENSSL_strtoul();
- libssl, demos and tests use OPENSSL_strtoul(); the test code shares
a single test_strtoint() helper rather than repeating the bound check
and cast per file;
- unsigned values use OPENSSL_strtoul(), with call-site-specific range
checks before narrowing where the destination type requires it.
Reject conversion failures and narrow through the helpers rather than
acting on garbage, and preserve the signed RSA-PSS saltlen sentinels
while rejecting invalid numeric strings. Add regression coverage for the
invalid RSA-PSS saltlen string path.
Fixes#8216
Assisted-by: OpenCode:GLM-5.2
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 29 17:02:18 2026
(Merged from https://github.com/openssl/openssl/pull/31731)
Daniel Kubec