X509_CMP_TIME(3ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💅 X509_CMP_TIME — the X509 time functions, bestie edition ✨

okay so this is from the <pink>3ossl</pink> manual — the OpenSSL girlies. it's literally all about comparing and adjusting ASN1_TIME values, and ngl it's lowkey iconic once you get it. let's go 🫶

🌸 NAME 🌸

X509_cmp_time, X509_cmp_current_time, X509_cmp_timeframe, X509_time_adj, X509_time_adj_ex, X509_gmtime_adj — the X509 time functions. that's the whole squad 💖

🦋 SYNOPSIS 🦋

int X509_cmp_time(const ASN1_TIME *asn1_time, time_t *in_tm);
int X509_cmp_current_time(const ASN1_TIME *asn1_time);
int X509_cmp_timeframe(const X509_VERIFY_PARAM *vpm,
                       const ASN1_TIME *start, const ASN1_TIME *end);
ASN1_TIME *X509_time_adj(ASN1_TIME *asn1_time, long offset_sec, time_t *in_tm);
ASN1_TIME *X509_time_adj_ex(ASN1_TIME *asn1_time, int offset_day, long
                            offset_sec, time_t *in_tm);
ASN1_TIME *X509_gmtime_adj(ASN1_TIME *asn1_time, long offset_sec);

🎀 DESCRIPTION 🎀

the comparing girlies ⭐

  • X509_cmp_time() — compares the ASN1_TIME in asn1_time against the time living in in_tm. that's it, that's the vibe.
  • X509_cmp_current_time() — same energy, but it compares asn1_time against the current time, expressed as time_t. right here, right now, main character energy 🕐
  • X509_cmp_timeframe() — compares the given time period against the reference time that's chillin' inside the verification parameters vpm, but only if vpm is not NULL and contains X509_V_FLAG_USE_CHECK_TIME. otherwise? the current time steps in as the reference time. slay 💅

the adjusting girlies ✨

  • X509_time_adj_ex() — sets the ASN1_TIME structure asn1_time to the time offset_day and offset_sec after in_tm. two offsets, double the fun 🎀
  • X509_time_adj() — sets the ASN1_TIME structure asn1_time to the time offset_sec after in_tm. ⚠️ heads up bestie: this one can only handle second offsets up to the capacity of long, so the newer X509_time_adj_ex() API should be preferred. it's giving deprecated-adjacent, iykyk 💀
  • X509_gmtime_adj() — sets the ASN1_TIME structure asn1_time to the time offset_sec after the current time. it's literally equivalent to calling X509_time_adj() with the last parameter as NULL. no cap 🌈

the rules that apply to everybody 👑

in both X509_time_adj_ex() and X509_time_adj(): if asn1_time is NULL, a new ASN1_TIME structure is allocated and returned. fresh out the box ✨

in all the methods: if in_tm is NULL, the current time is used, expressed as time_t. convenient or what 🍓

and like... asn1_time must satisfy the ASN1_TIME format mandated by RFC 5280. so its format has to be either YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ. no exceptions, no vibes-based formatting, periodt 💖

💀 BUGS 💀

okay this is the part where we all gasp 😭

unlike many standard comparison functions, X509_cmp_time() and X509_cmp_current_time() return 0 on error. so like... zero isn't always "equal", sometimes it's "girl something went wrong". be careful out there 🙈

🔥 RETURN VALUES 🔥

X509_cmp_time() and X509_cmp_current_time() return -1 if asn1_time is earlier than, or equal to, in_tm (resp. the current time), and 1 otherwise. and yes — they return 0 on error. we been knew 💅

X509_cmp_timeframe() returns 0 if vpm is not NULL and the verification parameters do not contain X509_V_FLAG_USE_CHECK_TIME but do contain X509_V_FLAG_NO_CHECK_TIME. otherwise:

  • returns 1 if the end time is not NULL and the reference time (determined as stated above, bestie, keep up ✨) is past the end time
  • returns -1 if the start time is not NULL and the reference time is before
  • else returns 0 to indicate that the reference time is in range (implying that the end time is not before the start time if both are present) 👑

X509_time_adj(), X509_time_adj_ex() and X509_gmtime_adj() return a pointer to the updated ASN1_TIME structure, and NULL on error. simple as 🦋

🌸 HISTORY 🌸

X509_cmp_timeframe() was added in OpenSSL 3.0. a whole new era 🎀

Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page bestie, you ate that 🫶✨

version 3.5.6 · dated 2026-04-07 · X509_CMP_TIME(3ossl) — mwah, go forth and compare your times responsibly 💖🎀🦋

📦 where this page comes from