mirror of
https://github.com/openssl/openssl.git
synced 2026-10-28 08:25:12 +08:00
Daniel Kubec
4a5704abc6
When the notBefore or notAfter field of a certificate cannot be parsed, X509_check_certificate_times() fails with an error other than X509_V_ERR_CERT_HAS_EXPIRED. The -checkend handling only reacted to that one error, so a certificate with a corrupt validity period printed nothing and exited with status zero, i.e. was treated as not expiring. The same silent success happened for a certificate that is not yet valid at the check time. Report an unparsable validity period as an error with a failing exit status. Report a certificate that only becomes valid after the check time as not expiring, which is what -checkend did before the switch to X509_check_certificate_times(), as it cannot expire before it is valid. Add regression tests with corrupted notBefore and notAfter fields, including with -multi, and with a not yet valid certificate. Document the behaviour. Resolves: https://github.com/openssl/openssl/issues/11772 Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Merge-date: Tue Oct 27 16:19:04 2026 Merged-from: https://github.com/openssl/openssl/pull/33105
OpenSSL Documentation
README.md This file
fingerprints.txt PGP fingerprints of authorised release signers
HOWTO/ A few how-to documents; not necessarily up-to-date
man1/ The openssl command-line tools; start with openssl.pod
man3/ The SSL library and the crypto library
man5/ File formats
man7/ Overviews; start with crypto.pod and ssl.pod, for example Algorithm specific EVP_PKEY documentation.
Directories above should contain public information and API documentation. For internal documentation (like an API included with headers in include/internal), use internal/ directory.
Formatted versions of the manpages (apps,ssl,crypto) can be found at https://docs.openssl.org/master/