X509_CMP_TIME(3ossl)

💅 X509_CMP_TIME (3ossl) — the OpenSSL time girlies

okay so bestie, this is the 3ossl page for the X509 time functions, and it's literally all about comparing and nudging ASN1_TIME values around. no cap, it's giving "clock management main character energy" ⏰✨

---

✨ NAME ✨

X509_cmp_time, X509_cmp_current_time, X509_cmp_timeframe, X509_time_adj, X509_time_adj_ex, X509_gmtime_adj — the X509 time functions, aka the whole friend group 🫶

---

🌸 SYNOPSIS 🌸

int X509_cmp_time(const ASN1_TIME *asn1_time, time_t *in_tm);
int X509_cmp_current_time(const ASN1_TIME *asn1_time);
int X509_cmp_timeframe(const X509_VERIFY_PARAM *vpm,
                       const ASN1_TIME *start, const ASN1_TIME *end);
ASN1_TIME *X509_time_adj(ASN1_TIME *asn1_time, long offset_sec, time_t *in_tm);
ASN1_TIME *X509_time_adj_ex(ASN1_TIME *asn1_time, int offset_day, long
                            offset_sec, time_t *in_tm);
ASN1_TIME *X509_gmtime_adj(ASN1_TIME *asn1_time, long offset_sec);

---

🦋 DESCRIPTION 🦋

Okay so here's the tea on each one, bestie 💖

X509_cmp_time() compares the ASN1_TIME sitting in asn1_time against the time in *in_tm. simple as that 🎀

X509_cmp_current_time() compares the ASN1_TIME in asn1_time against the current time, expressed as a time_t. like, right now. rn. ⏱️

X509_cmp_timeframe() compares the given time period against the reference time that lives inside the verification parameters vpm — but ONLY if vpm is not NULL and it actually contains X509_V_FLAG_USE_CHECK_TIME. otherwise? current time is the reference time. that's the vibe check 🌈

X509_time_adj_ex() sets the ASN1_TIME structure asn1_time to the time offset_day and offset_sec after in_tm. two offsets, one function, we love a multitasker 👑

X509_time_adj() sets the ASN1_TIME structure asn1_time to the time offset_sec after in_tm. heads up though — this method can only handle second offsets up to the capacity of long, so the newer X509_time_adj_ex() API should be preferred. she's a little limited, ok? respect her era 💅

In both methods, if asn1_time is NULL, a brand new ASN1_TIME structure gets allocated and returned. fresh out the box 🎁

In all methods, if in_tm is NULL, the current time — expressed as a time_t — is used. no time passed in? we just use now. iconic 🕰️

fr fr, asn1_time must satisfy the ASN1_TIME format mandated by RFC 5280. meaning its format has to be either YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ. no other formats, bestie, the RFC said what it said 💀

X509_gmtime_adj() sets the ASN1_TIME structure asn1_time to the time offset_sec after the current time. it's literally equivalent to calling X509_time_adj() with the last parameter as NULL, iykyk ✨

---

💀 BUGS 💀

not the plot twist 😭 — unlike many standard comparison functions, X509_cmp_time() and X509_cmp_current_time() return 0 on error. so like, zero doesn't mean "equal", it means "something went wrong". stay woke 🚨

---

🔥 RETURN VALUES 🔥

X509_cmp_time() and X509_cmp_current_time() return -1 if asn1_time is earlier than, or equal to, in_tm (resp. current time), and 1 otherwise. these methods return 0 on error. (yes, again — see BUGS above, it's giving chaos 🙈)

X509_cmp_timeframe() returns 0 if vpm is not NULL and the verification parameters do not contain X509_V_FLAG_USE_CHECK_TIME but do contain X509_V_FLAG_NO_CHECK_TIME. otherwise:

• it returns 1 if the end time is not NULL and the reference time (which has been determined as stated above) is past the end time,
• -1 if the start time is not NULL and the reference time is before,
• else 0 to indicate that the reference time is in range (implying that the end time is not before the start time if both are present). periodt 🫶

X509_time_adj(), X509_time_adj_ex() and X509_gmtime_adj() return a pointer to the updated ASN1_TIME structure, and NULL on error. slay ✨

---

👑 HISTORY 👑

X509_cmp_timeframe() was added in OpenSSL 3.0. she's relatively new here, be nice to her 🌸

---

🎀 COPYRIGHT 🎀

Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie 💖 this was OpenSSL 3.5.0, dated 2026-09-25 — go forth and compare your timestamps responsibly, mwah 🧚‍♀️💜