When the notBefore or notAfter field of a certificate cannot be parsed,
X509_check_certificate_times() fails with an error other than
X509_V_ERR_CERT_HAS_EXPIRED. The -checkend handling only reacted
to that one error, so a certificate with a corrupt validity period
printed nothing and exited with status zero, i.e. was treated
as not expiring. The same silent success happened for a certificate
that is not yet valid at the check time.
Report an unparsable validity period as an error with a failing exit
status. Report a certificate that only becomes valid after the check
time as not expiring, which is what -checkend did before the switch
to X509_check_certificate_times(), as it cannot expire
before it is valid.
Add regression tests with corrupted notBefore and notAfter fields,
including with -multi, and with a not yet valid certificate.
Document the behaviour.
Resolves: https://github.com/openssl/openssl/issues/11772
Assisted-by: Claude:claude-fable-5-1
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Merge-date: Tue Oct 27 16:19:04 2026
Merged-from: https://github.com/openssl/openssl/pull/33105
Daniel Kubec
4a5704abc6