X509_GET0_NOTBEFORE(3)

💅 X509_GET0_NOTBEFORE 💅

okay so bestie, welcome to the X509_GET0_NOTBEFORE(3) page — this is the library functions manual for the OpenSSL/BoringSSL-ish crew, and it's literally all about getting and setting certificate and CRL validity dates. dates! the little time windows that make certs valid or expired and give everyone trust issues 🫶

Real talk, the stars of this page are X509_get0_notBefore, X509_get0_notAfter, X509_getm_notBefore, X509_getm_notAfter, X509_get_notBefore, X509_get_notAfter, X509_CRL_get0_lastUpdate, X509_CRL_get0_nextUpdate, X509_CRL_get_lastUpdate, X509_CRL_get_nextUpdate, X509_set1_notBefore, X509_set1_notAfter, X509_set_notBefore, X509_set_notAfter, X509_CRL_set1_lastUpdate, X509_CRL_set1_nextUpdate, X509_CRL_set_lastUpdate, and X509_CRL_set_nextUpdate. yes that's a lot of names, no I'm not sorry, they're all here and they're all iconic 💖

---

✨ SYNOPSIS ✨

#include <openssl/x509.h>

const ASN1_TIME *
X509_get0_notBefore(const X509 *x);

const ASN1_TIME *
X509_get0_notAfter(const X509 *x);

ASN1_TIME *
X509_getm_notBefore(const X509 *x);

ASN1_TIME *
X509_getm_notAfter(const X509 *x);

ASN1_TIME *
X509_get_notBefore(const X509 *x);

ASN1_TIME *
X509_get_notAfter(const X509 *x);

const ASN1_TIME *
X509_CRL_get0_lastUpdate(const X509_CRL *crl);

const ASN1_TIME *
X509_CRL_get0_nextUpdate(const X509_CRL *crl);

ASN1_TIME *
X509_CRL_get_lastUpdate(X509_CRL *crl);

ASN1_TIME *
X509_CRL_get_nextUpdate(X509_CRL *crl);

int
X509_set1_notBefore(X509 *x, const ASN1_TIME *tm);

int
X509_set1_notAfter(X509 *x, const ASN1_TIME *tm);

int
X509_set_notBefore(X509 *x, const ASN1_TIME *tm);

int
X509_set_notAfter(X509 *x, const ASN1_TIME *tm);

int
X509_CRL_set1_lastUpdate(X509_CRL *crl, const ASN1_TIME *tm);

int
X509_CRL_set1_nextUpdate(X509_CRL *crl, const ASN1_TIME *tm);

int
X509_CRL_set_lastUpdate(X509_CRL *crl, const ASN1_TIME *tm);

int
X509_CRL_set_nextUpdate(X509_CRL *crl, const ASN1_TIME *tm);

---

🦋 DESCRIPTION 🦋

okay so let's get into it 💅

X509_getm_notBefore() and X509_getm_notAfter() return pointers to the notBefore and notAfter fields of the validity period of the certificate x, respectively. cute, straightforward, we love to see it ✨ and heads up: X509_get_notBefore() and X509_get_notAfter() are deprecated aliases implemented as macros. deprecated besties, so maybe don't build your whole personality on them 🙈

X509_get0_notBefore() and X509_get0_notAfter() are identical except for the const qualifier on the return type. that's it, that's the whole difference, const is the main character here 👑

now, the CRL side gets a lil spicy 🌶️ X509_CRL_get0_lastUpdate() is misnamed in a confusing way: it returns a pointer to the thisUpdate field of the crl, indicating the time when this crl was issued. like, "lastUpdate" but it's actually thisUpdate? not me side-eyeing the naming committee 😭 iykyk.

X509_CRL_get0_nextUpdate() returns a pointer to the nextUpdate field of the crl, indicating the time when issuing the subsequent CRL will be due. future vibes only 🦋

X509_CRL_get_lastUpdate() and X509_CRL_get_nextUpdate() are deprecated and identical except for the const qualifier on the argument and on the return type. deprecated era, we're moving on 🎀

now the setters, aka the ones that actually change stuff 💅 X509_set1_notBefore(), X509_set1_notAfter(), X509_CRL_set1_lastUpdate(), and X509_CRL_set1_nextUpdate() set the notBefore, notAfter, thisUpdate (sic!), or nextUpdate field of x or crl, respectively, to a deep copy of tm and free the ASN1_TIME value that they replace. deep copy!! free the old one!! very responsible, we stan 🌸

and X509_set_notBefore(), X509_set_notAfter(), X509_CRL_set_lastUpdate(), and X509_CRL_set_nextUpdate() are deprecated aliases. yeah. you know the drill. deprecated 🫶

---

🌈 RETURN VALUES 🌈

the get functions return internal pointers which must not be freed by the application, or NULL if the requested field is not available. do not free them bestie, they're internal, not yours, hands off 🙅‍♀️

💀 also... they may crash with a NULL pointer access if x or crl is NULL. so like. don't do that. fr fr.

the set functions return 1 on success or 0 on failure. slay. they fail if x is NULL or does not contain a validity substructure, if crl is NULL, or if ASN1_STRING_dup(3) fails. all the ways to fail, documented, we love transparency ✨

except for some cases of ASN1_STRING_dup(3) failure, these functions do not support determining reasons for failure with ERR_get_error(3). so like, don't go asking ERR_get_error(3) why it broke, it won't know 😭

---

👑 SEE ALSO 👑

ASN1_TIME_set(3), X509_cmp_time(3), X509_CRL_get0_by_serial(3), X509_CRL_new(3), X509_get_subject_name(3), X509_new(3), X509_sign(3), X509_VAL_new(3), X509_verify_cert(3)

the whole friend group, go read them all 🫶

---

🎀 HISTORY 🎀

storytime, gather round 🧚

X509_get_notBefore(), X509_get_notAfter(), X509_set_notBefore(), and X509_set_notAfter() first appeared in SSLeay 0.6.5 and have been available since OpenBSD 2.4. ancient. vintage. iconic ⭐

X509_CRL_get_lastUpdate() and X509_CRL_get_nextUpdate() first appeared in OpenSSL 0.9.2 and have been available since OpenBSD 2.6.

X509_CRL_set_lastUpdate() and X509_CRL_set_nextUpdate() first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2.

the remaining functions first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 6.3. the babies of the group, still grown though 💜

---

okay that's the whole page bestie, you're officially certified in certificate validity dates 🎓✨ this dropped in the Debian package, dated March 5, 2024, and it's the X509_GET0_NOTBEFORE(3) page — go forth and set your notAfter responsibly 💖🌸🦋