X509_GET0_NOTBEFORE(3ossl)

🌸 NAME 🌸

okay bestie, welcome to the OpenSSL X509_GET0_NOTBEFORE(3ossl) manual page — it's literally the get-and-set date-field cheat sheet for certs and CRLs 💅✨

Here's the whole squad: X509_get0_notBefore, X509_getm_notBefore, X509_get0_notAfter, X509_getm_notAfter, X509_set1_notBefore, X509_set1_notAfter, X509_ACERT_get0_notBefore, X509_ACERT_get0_notAfter, X509_ACERT_set1_notBefore, X509_ACERT_set1_notAfter, X509_CRL_get0_lastUpdate, X509_CRL_get0_nextUpdate, X509_CRL_set1_lastUpdate, X509_CRL_set1_nextUpdate — and their whole job is get or set certificate or CRL dates. periodt. 🎀

✨ SYNOPSIS ✨

#include <openssl/x509.h>

const ASN1_TIME *X509_get0_notBefore(const X509 *x);
const ASN1_TIME *X509_get0_notAfter(const X509 *x);

ASN1_TIME *X509_getm_notBefore(const X509 *x);
ASN1_TIME *X509_getm_notAfter(const X509 *x);

int X509_set1_notBefore(X509 *x, const ASN1_TIME *tm);
int X509_set1_notAfter(X509 *x, const ASN1_TIME *tm);

const ASN1_GENERALIZEDTIME *X509_ACERT_get0_notBefore(const X509 *x);
const ASN1_GENERALIZEDTIME *X509_ACERT_get0_notAfter(const X509 *x);

int X509_ACERT_set1_notBefore(X509_ACERT *x, const ASN1_GENERALIZEDTIME *tm);
int X509_ACERT_set1_notAfter(X509_ACERT *x, const ASN1_GENERALIZEDTIME *tm);

const ASN1_TIME *X509_CRL_get0_lastUpdate(const X509_CRL *crl);
const ASN1_TIME *X509_CRL_get0_nextUpdate(const X509_CRL *crl);

int X509_CRL_set1_lastUpdate(X509_CRL *x, const ASN1_TIME *tm);
int X509_CRL_set1_nextUpdate(X509_CRL *x, const ASN1_TIME *tm);

🦋 DESCRIPTION 🦋

okay so first up, the X509 date getters: X509_get0_notBefore() and X509_get0_notAfter() hand you the notBefore and notAfter fields of certificate x respectively. Important vibe check: the value returned is an internal pointer which must not be freed up after the call.

🚨 and bestie, x MUST NOT be NULL. Not even a little.

X509_getm_notBefore() and X509_getm_notAfter() are similar to X509_get0_notBefore() and X509_get0_notAfter() except they return non-constant mutable references to the associated date field of the certificate. mutable, icon behavior 💅

X509_set1_notBefore() and X509_set1_notAfter() set the notBefore and notAfter fields of x to tm. Ownership of the passed parameter tm is not transferred by these functions so it must be freed up after the call. no take-backs, you still own tm, bestie.

X509_ACERT_get0_notBefore() and X509_ACERT_get0_notAfter() return the notBefore and notAfter fields of certificate x respectively. the thing returned is an internal pointer which must not be freed up after the call. same energy: do not free it, bestie 🫶

X509_ACERT_set1_notBefore() and X509_ACERT_set1_notAfter() set the notBefore and notAfter fields of x to tm. Ownership of the passed parameter tm is not transferred by these functions so it must be freed up after the call.

X509_CRL_get0_lastUpdate() and X509_CRL_get0_nextUpdate() return the lastUpdate and nextUpdate fields of crl. The value returned is an internal pointer which must not be freed up after the call. If the nextUpdate field is absent from crl then NULL is returned. so if you get NULL, that's literally the field being absent, not a glitch.

X509_CRL_set1_lastUpdate() and X509_CRL_set1_nextUpdate() set the lastUpdate and nextUpdate fields of crl to tm. Ownership of the passed parameter tm is not transferred by these functions so it must be freed up after the call. For X509_CRL_set1_nextUpdate() the tm argument may be NULL, which implies removal of the optional nextUpdate field. yes, passing NULL here is the "delete the optional field" move 👀

💖 RETURN VALUES 💖

X509_get0_notBefore(), X509_get0_notAfter() and X509_CRL_get0_lastUpdate() return a pointer to an ASN1_TIME structure. slay, a pointer.

X509_CRL_get0_lastUpdate() return a pointer to an ASN1_TIME structure or NULL if the lastUpdate field is absent. yes, this line says lastUpdate — I'm just reading the page, bestie 💀

X509_set1_notBefore(), X509_set1_notAfter(), X509_CRL_set1_lastUpdate() and X509_CRL_set1_nextUpdate() return 1 for success or 0 for failure. so check that return value, bestie — 1 is the win, 0 is the flop.

🎀 NOTES 🎀

little format plot twist: unlike the X509 and X509_CRL routines, the X509_ACERT routines use the ASN1_GENERALIZEDTIME format instead of ASN1_TIME for holding time data. iykyk ✨

🌈 SEE ALSO 🌈

• d2i_X509(3)
• ASN1_GENERALIZEDTIME_check(3)
• ERR_get_error(3)
• X509_CRL_get0_by_serial(3)
• X509_get0_signature(3)
• X509_get_ext_d2i(3)
• X509_get_extension_flags(3)
• X509_get_pubkey(3)
• X509_get_subject_name(3)
• X509_NAME_add_entry_by_txt(3)
• X509_NAME_ENTRY_get_object(3)
• X509_NAME_get_index_by_NID(3)
• X509_NAME_print_ex(3)
• X509_new(3)
• X509_sign(3)
• X509V3_get_d2i(3)
• X509_verify_cert(3)

⭐ HISTORY ⭐

X509_get_notBefore() and X509_get_notAfter() were deprecated in OpenSSL 1.1.0. deprecated in OpenSSL 1.1.0 — that's the whole tea.

X509_ACERT_get0_notBefore(), X509_ACERT_get0_notAfter(), X509_ACERT_set1_notBefore(), X509_ACERT_set1_notAfter() were added in OpenSSL 3.4. new-ish era, periodt.

👑 COPYRIGHT 👑

Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

mwah 💋 this page is from OpenSSL 3.5.6, dated 2026-04-07, and it's the X509_GET0_NOTBEFORE(3ossl) manual — go get those cert dates, bestie 🫶✨