Simplify x509 time checking #28987

bob-beck · 2025-10-23T19:47:10Z

This changes x509 verification to use int64 values of epoch seconds internally instead of time_t. While time values from a system will still come from/to a platform dependant time_t which could be range constrained, we can simplify this to convert the certificate time to a posix time and then just do a normal comparison of the int64_t values. This removes the need to do further computation to compare values which potentially do not cover the range of certificate times, and makes the internal functions a bit more readable.

This also modifies the tests to ensure the full range of times are tested, without depending on time_t, and adds tests for checking CRL expiry, which were lacking before.

Fixes: 1694

Fixes: #29021

Checklist

documentation is added or updated
tests are added or updated

Sashan

looks good to me as far as I can tell.

crypto/x509/x509_vfy.c

nhorman · 2025-10-29T16:05:14Z

@bob-beck does this also fix #29021 ?

Edit: I just checked, and building for 32 bit systems still fails with this PR. It seems like it should have fixed that case, but it doesn't seem to have

nhorman

see comment above, building for 32 bit platforms (specifically with a 32 bit time_t), the x509_test_internal tests still fail.

openssl-machine · 2025-10-30T07:23:27Z

24 hours has passed since 'approval: done' was set, but as this PR has been updated in that time the label 'approval: ready to merge' is not being automatically set. Please review the updates and set the label manually.

bob-beck · 2025-10-30T18:54:43Z

see comment above, building for 32 bit platforms (specifically with a 32 bit time_t), the x509_test_internal tests still fail.

I think this should now work on those, I was still using ASN1_TIME_adj() in the internal test which is time_t dependent.

nhorman · 2025-10-30T19:10:14Z

sorry, no dice. building at commit 64af80f for linux-x86:

nhorman@hmsbeagle:~/git/worktrees/old$ make TESTS=test_internal_x509 test

"make" depend && "make" _tests
make[1]: Entering directory '/home/nhorman/git/worktrees/old'
make[1]: Leaving directory '/home/nhorman/git/worktrees/old'
make[1]: Entering directory '/home/nhorman/git/worktrees/old'
"make" run_tests
make[2]: Entering directory '/home/nhorman/git/worktrees/old'
( SRCTOP=. \
  BLDTOP=. \
  PERL="/usr/bin/perl" \
  FIPSKEY="f4556650ac31d35461610bac4ed81b1a181b2d8a43ea2854cbae22ca74560813" \
  EXE_EXT= \
  /usr/bin/perl ./test/run_tests.pl test_internal_x509 )
Using HARNESS_JOBS=32

00-prep_fipsmodule_cnf.t .. skipped: FIPS module config file only supported in a fips build
Files=1, Tests=0,  0 wallclock secs ( 0.00 usr  0.00 sys +  0.07 cusr  0.00 csys =  0.07 CPU)
Result: NOTESTS

#     # Subtest: ../../test/x509_internal_test
#     1..4
#     ok 1 - test_standard_exts
#         # Subtest: test_a2i_ipaddress
#         1..62
#         ok 1 - iteration 1
#         ok 2 - iteration 2
#         ok 3 - iteration 3
#         ok 4 - iteration 4
#         ok 5 - iteration 5
#         ok 6 - iteration 6
#         ok 7 - iteration 7
#         ok 8 - iteration 8
#         ok 9 - iteration 9
#         ok 10 - iteration 10
#         ok 11 - iteration 11
#         ok 12 - iteration 12
#         ok 13 - iteration 13
#         ok 14 - iteration 14
#         ok 15 - iteration 15
#         ok 16 - iteration 16
#         ok 17 - iteration 17
#         ok 18 - iteration 18
#         ok 19 - iteration 19
#         ok 20 - iteration 20
#         ok 21 - iteration 21
#         ok 22 - iteration 22
#         ok 23 - iteration 23
#         ok 24 - iteration 24
#         ok 25 - iteration 25
#         ok 26 - iteration 26
#         ok 27 - iteration 27
#         ok 28 - iteration 28
#         ok 29 - iteration 29
#         ok 30 - iteration 30
#         ok 31 - iteration 31
#         ok 32 - iteration 32
#         ok 33 - iteration 33
#         ok 34 - iteration 34
#         ok 35 - iteration 35
#         ok 36 - iteration 36
#         ok 37 - iteration 37
#         ok 38 - iteration 38
#         ok 39 - iteration 39
#         ok 40 - iteration 40
#         ok 41 - iteration 41
#         ok 42 - iteration 42
#         ok 43 - iteration 43
#         ok 44 - iteration 44
#         ok 45 - iteration 45
#         ok 46 - iteration 46
#         ok 47 - iteration 47
#         ok 48 - iteration 48
#         ok 49 - iteration 49
#         ok 50 - iteration 50
#         ok 51 - iteration 51
#         ok 52 - iteration 52
#         ok 53 - iteration 53
#         ok 54 - iteration 54
#         ok 55 - iteration 55
#         ok 56 - iteration 56
#         ok 57 - iteration 57
#         ok 58 - iteration 58
#         ok 59 - iteration 59
#         ok 60 - iteration 60
#         ok 61 - iteration 61
#         ok 62 - iteration 62
#     ok 2 - test_a2i_ipaddress
#     ok 3 - tests_X509_PURPOSE
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:449 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 0 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:453 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 0 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore 0, notAfter 0 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:482 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 0 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:486 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 0 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:449 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 1 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:453 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 1 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore 0, notAfter 1 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:482 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 1 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:486 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 1 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:449 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 1, notAfter 1 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:453 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 1, notAfter 1 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:482 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 1, notAfter 1 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:486 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 1, notAfter 1 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:449 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore -1, notAfter 0 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:453 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore -1, notAfter 0 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -1, notAfter 0 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:482 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -1, notAfter 0 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:486 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -1, notAfter 0 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:449 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore -1, notAfter 1 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:453 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore -1, notAfter 1 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -1, notAfter 1 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:482 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -1, notAfter 1 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:486 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -1, notAfter 1 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:449 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 1442939232, notAfter 1443004020 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:453 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 1442939232, notAfter 1443004020 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:482 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 1442939232, notAfter 1443004020 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:486 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 1442939232, notAfter 1443004020 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:429 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 2147483647 at time 2147483648
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:449 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 2147483647 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:453 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 2147483647 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore 0, notAfter 2147483647 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:482 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 2147483647 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:486 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 2147483647 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:408 - ossl_X509_check_certificate_times error return was 10, expected 9 when verifying notBefore -2147483648, notAfter 0 at time -2147483649
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:449 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -2147483648, notAfter 0 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:453 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -2147483648, notAfter 0 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -2147483648, notAfter 0 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:482 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -2147483648, notAfter 0 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:486 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -2147483648, notAfter 0 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:408 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -2147483648, notAfter 2147483647 at time -2147483649
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:429 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -2147483648, notAfter 2147483647 at time 2147483648
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:449 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -2147483648, notAfter 2147483647 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:453 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -2147483648, notAfter 2147483647 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -2147483648, notAfter 2147483647 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:482 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -2147483648, notAfter 2147483647 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:486 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -2147483648, notAfter 2147483647 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:421 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 4294967295 at time 4294967294
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:425 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 4294967295 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:429 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore 0, notAfter 4294967295 at time 4294967296
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:449 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 4294967295 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:453 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 4294967295 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore 0, notAfter 4294967295 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:482 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 4294967295 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:486 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 4294967295 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:449 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore -631152000, notAfter 0 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:453 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore -631152000, notAfter 0 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -631152000, notAfter 0 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:482 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -631152000, notAfter 0 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:486 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -631152000, notAfter 0 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:449 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore -631152001, notAfter 0 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:453 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore -631152001, notAfter 0 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -631152001, notAfter 0 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:482 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -631152001, notAfter 0 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:486 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -631152001, notAfter 0 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:421 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 2524607999 at time 2524607998
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:425 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 2524607999 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:429 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 2524607999 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:449 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 2524607999 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:453 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 2524607999 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore 0, notAfter 2524607999 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:482 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 2524607999 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:486 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 2524607999 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:421 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 2524608000 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:425 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 2524608000 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:429 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 2524608000 at time 2524608001
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:449 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 2524608000 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:453 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 2524608000 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore 0, notAfter 2524608000 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:482 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 2524608000 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:486 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 2524608000 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:421 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore -631152000, notAfter 2524607999 at time 2524607998
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:425 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore -631152000, notAfter 2524607999 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:429 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore -631152000, notAfter 2524607999 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:449 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore -631152000, notAfter 2524607999 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:453 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore -631152000, notAfter 2524607999 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -631152000, notAfter 2524607999 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:482 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -631152000, notAfter 2524607999 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:486 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -631152000, notAfter 2524607999 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:421 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore -631152001, notAfter 2524608000 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:425 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore -631152001, notAfter 2524608000 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:429 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore -631152001, notAfter 2524608000 at time 2524608001
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:449 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore -631152001, notAfter 2524608000 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:453 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore -631152001, notAfter 2524608000 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -631152001, notAfter 2524608000 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:482 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -631152001, notAfter 2524608000 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:486 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -631152001, notAfter 2524608000 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:408 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -62167219200, notAfter 253402300799 at time -62167219201
    # 
    # INFO:  @ test/x509_internal_test.c:304
    # test/x509_internal_test.c:429 - ossl_X509_check_crl_time failed unexpectedly when verifying lastUpdate -62167219200, nextUpdate 253402300799 at time 253402300800
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -62167219200, notAfter 253402300799 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:304
    # test/x509_internal_test.c:486 - ossl_X509_check_crl_time failed unexpectedly when verifying lastUpdate -62167219200, nextUpdate 253402300799 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:408 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -62167219200, notAfter 253402300798 at time -62167219201
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:429 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -62167219200, notAfter 253402300798 at time 253402300799
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -62167219200, notAfter 253402300798 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:486 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -62167219200, notAfter 253402300798 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:408 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -62167219199, notAfter 253402300799 at time -62167219200
    # 
    # INFO:  @ test/x509_internal_test.c:304
    # test/x509_internal_test.c:429 - ossl_X509_check_crl_time failed unexpectedly when verifying lastUpdate -62167219199, nextUpdate 253402300799 at time 253402300800
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -62167219199, notAfter 253402300799 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:304
    # test/x509_internal_test.c:486 - ossl_X509_check_crl_time failed unexpectedly when verifying lastUpdate -62167219199, nextUpdate 253402300799 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:408 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -62167219199, notAfter 253402300798 at time -62167219200
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:429 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -62167219199, notAfter 253402300798 at time 253402300799
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -62167219199, notAfter 253402300798 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:486 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore -62167219199, notAfter 253402300798 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:421 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 253402300799 at time 253402300798
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:425 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 253402300799 at time 253402300799
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:429 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 253402300799 at time 253402300800
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:449 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 253402300799 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:453 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 253402300799 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore 0, notAfter 253402300799 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:482 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 253402300799 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:486 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 253402300799 at time 9223372036854775807
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:421 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 253402300798 at time 253402300797
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:425 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 253402300798 at time 253402300798
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:429 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 253402300798 at time 253402300799
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:449 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 253402300798 at time 2524607999
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:453 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 253402300798 at time 2524608000
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:458 - ossl_X509_check_cert_time succeeded unexpectedly when verifying notBefore 0, notAfter 253402300798 at time -9223372036854775808
    # 
    # INFO:  @ test/x509_internal_test.c:295
    # test/x509_internal_test.c:482 - ossl_X509_check_cert_time failed unexpectedly when verifying notBefore 0, notAfter 253402300798 at time 4294967295
    # 
    # INFO:  @ test/x509_internal_test.c:323
    # test/x509_internal_test.c:486 - ossl_X509_check_certificate_times error return was 9, expected 10 when verifying notBefore 0, notAfter 253402300798 at time 9223372036854775807
    # 
#     # OPENSSL_TEST_RAND_SEED=1761851350
#     not ok 4 - tests_X509_check_time
../../util/wrap.pl ../../test/x509_internal_test => 1
not ok 1 - running x509_internal_test
# ------------------------------------------------------------------------------
#   Failed test 'running x509_internal_test'
#   at /home/nhorman/git/worktrees/old/util/perl/OpenSSL/Test/Simple.pm line 77.
# Looks like you failed 1 test of 1.03-test_internal_x509.t .. 
Dubious, test returned 1 (wstat 256, 0x100)
Failed 1/1 subtests 

Test Summary Report
-------------------
03-test_internal_x509.t (Wstat: 256 (exited 1) Tests: 1 Failed: 1)
  Failed test:  1
  Non-zero exit status: 1
Files=1, Tests=1,  0 wallclock secs ( 0.01 usr  0.00 sys +  0.05 cusr  0.02 csys =  0.08 CPU)
Result: FAIL
make[2]: *** [Makefile:4026: run_tests] Error 1
make[2]: Leaving directory '/home/nhorman/git/worktrees/old'
make[1]: *** [Makefile:4023: _tests] Error 2
make[1]: Leaving directory '/home/nhorman/git/worktrees/old'
make: *** [Makefile:4021: tests] Error 2

bob-beck · 2025-10-31T17:18:25Z

sorry, no dice. building at commit 64af80f for linux-x86:

Bah, I'm an idiot, I was using X509_VERIFY_PARAM_set_time(...) to set the test verification time in the test,
and like, duh, that goes through time_t.

Now fixed.

And rebased because this was becoming unwieldy.

This changes x509 verification to use int64 values of epoch seconds internally instead of time_t. While time values from a system will still come from/to a platform dependant time_t which could be range constrained, we can simplify this to convert the certificate time to a posix time and then just do a normal comparison of the int64_t values. This removes the need to do further computation to compare values which potentially do not cover the range of certificate times, and makes the internal functions a bit more readable. This also modifies the tests to ensure the full range of times are tested, without depending on time_t, and adds tests for checking CRL expiry, which were lacking before.

nhorman

works on x86 now, thanks!

test/x509_internal_test.c

openssl-machine · 2025-11-14T05:00:48Z

This pull request is ready to merge

t8m · 2025-11-14T08:49:11Z

Merged to the master branch. Thank you.

This changes x509 verification to use int64 values of epoch seconds internally instead of time_t. While time values from a system will still come from/to a platform dependant time_t which could be range constrained, we can simplify this to convert the certificate time to a posix time and then just do a normal comparison of the int64_t values. This removes the need to do further computation to compare values which potentially do not cover the range of certificate times, and makes the internal functions a bit more readable. This also modifies the tests to ensure the full range of times are tested, without depending on time_t, and adds tests for checking CRL expiry, which were lacking before. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #28987)

bob-beck marked this pull request as draft October 23, 2025 19:47

bob-beck force-pushed the time_t-considered-harmful branch from 1a37822 to e5a0687 Compare October 23, 2025 19:51

bob-beck self-assigned this Oct 23, 2025

bob-beck requested review from Sashan and nhorman October 23, 2025 20:03

bob-beck marked this pull request as ready for review October 23, 2025 20:04

bob-beck force-pushed the time_t-considered-harmful branch 2 times, most recently from a77b1c4 to bd81a6e Compare October 23, 2025 21:08

paulidale previously approved these changes Oct 26, 2025

View reviewed changes

paulidale added branch: master Applies to master branch approval: review pending This pull request needs review by a committer tests: exempted The PR is exempt from requirements for testing labels Oct 26, 2025

Sashan previously approved these changes Oct 27, 2025

View reviewed changes

Sashan added approval: done This pull request has the required number of approvals and removed approval: review pending This pull request needs review by a committer labels Oct 27, 2025

FdaSilvaYY reviewed Oct 27, 2025

View reviewed changes

crypto/x509/x509_vfy.c Outdated Show resolved Hide resolved

FdaSilvaYY reviewed Oct 27, 2025

View reviewed changes

crypto/x509/x509_vfy.c Outdated Show resolved Hide resolved

bob-beck dismissed stale reviews from Sashan and paulidale via f4ab0ae October 27, 2025 15:03

bob-beck requested review from Sashan and paulidale October 27, 2025 15:03

nhorman requested changes Oct 29, 2025

View reviewed changes

nhorman added approval: review pending This pull request needs review by a committer and removed approval: done This pull request has the required number of approvals labels Oct 30, 2025

bob-beck mentioned this pull request Oct 30, 2025

make test failed for Linux 32 bit build - x509_internal_test.c (master branch) #29021

Closed

bob-beck requested a review from nhorman October 30, 2025 18:55

bob-beck force-pushed the time_t-considered-harmful branch from 7d7a422 to e92b08e Compare October 31, 2025 17:16

bob-beck force-pushed the time_t-considered-harmful branch from e92b08e to d355f59 Compare October 31, 2025 17:22

DajanaV mentioned this pull request Oct 31, 2025

UPSTREAM PR #28987: Simplify x509 time checking auroralabs-loci/openssl#12

Open

2 tasks

nhorman previously approved these changes Oct 31, 2025

View reviewed changes

bob-beck requested a review from t8m November 10, 2025 17:28

t8m added the triaged: refactor The issue/pr requests/implements refactoring label Nov 10, 2025

t8m requested changes Nov 10, 2025

View reviewed changes

test/x509_internal_test.c Outdated Show resolved Hide resolved

test/x509_internal_test.c Outdated Show resolved Hide resolved

test/x509_internal_test.c Outdated Show resolved Hide resolved

test/x509_internal_test.c Outdated Show resolved Hide resolved

fixup! Simplify x509 time checking

8241138

bob-beck dismissed nhorman’s stale review via 8241138 November 11, 2025 00:22

bob-beck requested review from nhorman and t8m November 11, 2025 00:23

paulidale requested changes Nov 11, 2025

View reviewed changes

test/x509_internal_test.c Show resolved Hide resolved

test/x509_internal_test.c Outdated Show resolved Hide resolved

test/x509_internal_test.c Show resolved Hide resolved

test/x509_internal_test.c Outdated Show resolved Hide resolved

test/x509_internal_test.c Outdated Show resolved Hide resolved

t8m mentioned this pull request Nov 11, 2025

add CI job for linux-x86 target #29123

Closed

fixup! Simplify x509 time checking

6dca2dd

bob-beck requested a review from paulidale November 12, 2025 17:00

nhorman approved these changes Nov 13, 2025

View reviewed changes

paulidale approved these changes Nov 13, 2025

View reviewed changes

paulidale added approval: done This pull request has the required number of approvals and removed approval: review pending This pull request needs review by a committer labels Nov 13, 2025

t8m approved these changes Nov 13, 2025

View reviewed changes

openssl-machine added approval: ready to merge The 24 hour grace period has passed, ready to merge and removed approval: done This pull request has the required number of approvals labels Nov 14, 2025

t8m closed this Nov 14, 2025

Uh oh!

Simplify x509 time checking #28987

Simplify x509 time checking #28987

Uh oh!

Conversation

bob-beck commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Uh oh!

Sashan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

nhorman commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nhorman left a comment

Choose a reason for hiding this comment

Uh oh!

openssl-machine commented Oct 30, 2025

Uh oh!

bob-beck commented Oct 30, 2025

Uh oh!

nhorman commented Oct 30, 2025

Uh oh!

bob-beck commented Oct 31, 2025

Uh oh!

nhorman left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

openssl-machine commented Nov 14, 2025

Uh oh!

t8m commented Nov 14, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

bob-beck commented Oct 23, 2025 •

edited

Loading

nhorman commented Oct 29, 2025 •

edited

Loading