X509_GET0_NOTBEFORE(3)

💅 X509_GET0_NOTBEFORE(3) — get and set certificate and CRL validity dates

okay so this is from the Library Functions Manual, and it's literally all about the validity dates on certs and CRLs — like, the "best before" stickers but for crypto. 🎀 bestie, let's get into it.

---

✨ SYNOPSIS ✨

library libcrypto

#include <openssl/x509.h>

const ASN1_TIME *
X509_get0_notBefore(const X509 *x);

const ASN1_TIME *
X509_get0_notAfter(const X509 *x);

ASN1_TIME *
X509_getm_notBefore(const X509 *x);

ASN1_TIME *
X509_getm_notAfter(const X509 *x);

ASN1_TIME *
X509_get_notBefore(const X509 *x);

ASN1_TIME *
X509_get_notAfter(const X509 *x);

const ASN1_TIME *
X509_CRL_get0_lastUpdate(const X509_CRL *crl);

const ASN1_TIME *
X509_CRL_get0_nextUpdate(const X509_CRL *crl);

ASN1_TIME *
X509_CRL_get_lastUpdate(X509_CRL *crl);

ASN1_TIME *
X509_CRL_get_nextUpdate(X509_CRL *crl);

int
X509_set1_notBefore(X509 *x, const ASN1_TIME *tm);

int
X509_set1_notAfter(X509 *x, const ASN1_TIME *tm);

int
X509_set_notBefore(X509 *x, const ASN1_TIME *tm);

int
X509_set_notAfter(X509 *x, const ASN1_TIME *tm);

int
X509_CRL_set1_lastUpdate(X509_CRL *crl, const ASN1_TIME *tm);

int
X509_CRL_set1_nextUpdate(X509_CRL *crl, const ASN1_TIME *tm);

int
X509_CRL_set_lastUpdate(X509_CRL *crl, const ASN1_TIME *tm);

int
X509_CRL_set_nextUpdate(X509_CRL *crl, const ASN1_TIME *tm);

---

🦋 DESCRIPTION 🦋

so X509_getm_notBefore() and X509_getm_notAfter() hand you back pointers to the notBefore and notAfter fields of the validity period of the certificate x, respectively. cute, right? 💖

and just so we're clear — X509_get_notBefore() and X509_get_notAfter() are deprecated aliases, implemented as macros. ngl, don't be using those, bestie.

X509_get0_notBefore() and X509_get0_notAfter() do the exact same thing, the only difference being the const qualifier on the return type. that's it. that's the whole vibe. ✨

okay so this next one is a whole situation: X509_CRL_get0_lastUpdate() is misnamed in a confusing way 😭 — it actually returns a pointer to the thisUpdate field of the crl, which indicates the time when this crl was issued. like girl, the name is not mathing, but okay.

X509_CRL_get0_nextUpdate() returns a pointer to the nextUpdate field of the crl, indicating the time when issuing the subsequent CRL will be due. ⏰

X509_CRL_get_lastUpdate() and X509_CRL_get_nextUpdate() are deprecated and identical except for the const qualifier on the argument and on the return type. lowkey legacy code energy.

now for the setters, bestie: X509_set1_notBefore(), X509_set1_notAfter(), X509_CRL_set1_lastUpdate(), and X509_CRL_set1_nextUpdate() set the notBefore, notAfter, thisUpdate (sic! — yes really, that's what it says 🙈), or nextUpdate field of x or crl, respectively, to a deep copy of tm, and they free the ASN1_TIME value that they replace. iconic behavior, honestly. 🫶

last but not least, X509_set_notBefore(), X509_set_notAfter(), X509_CRL_set_lastUpdate(), and X509_CRL_set_nextUpdate() are deprecated aliases. she's retired, respectfully. 💀

---

🌸 RETURN VALUES 🌸

the get functions return internal pointers which must not be freed by the application, or NULL if the requested field is not available.

⚠️ heads up bestie — they may crash with a NULL pointer access if x or crl is NULL. like, do not test your luck here. 💀

the set functions return 1 on success or 0 on failure. they fail if x is NULL or does not contain a validity substructure, if crl is NULL, or if ASN1_STRING_dup(3) fails.

and except for some cases of ASN1_STRING_dup(3) failure, these functions do not support determining reasons for failure with ERR_get_error(3). so like, you get a 0 and that's all you're getting, no extra lore, no explanation. 😭

---

🌈 SEE ALSO 🌈

• ASN1_TIME_set(3)
• X509_cmp_time(3)
• X509_CRL_get0_by_serial(3)
• X509_CRL_new(3)
• X509_get_subject_name(3)
• X509_new(3)
• X509_sign(3)
• X509_VAL_new(3)
• X509_verify_cert(3)

---

👑 HISTORY 👑

X509_get_notBefore(), X509_get_notAfter(), X509_set_notBefore(), and X509_set_notAfter() first appeared in SSLeay 0.6.5 and have been available since OpenBSD 2.4. ancient. vintage. main character energy. 🕰️

X509_CRL_get_lastUpdate() and X509_CRL_get_nextUpdate() first appeared in OpenSSL 0.9.2 and have been available since OpenBSD 2.6.

X509_CRL_set_lastUpdate() and X509_CRL_set_nextUpdate() first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2.

and the remaining functions first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 6.3. the new kids on the block fr fr. ✨

---

and that's the whole page, bestie! 💖 sourced from Debian, dated June 8, 2025 — periodt. 🎀 go forth and slay your validity dates. 🦋