X509_GET0_NOTBEFORE(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

💖 X509_GET0_NOTBEFORE — bestie's guide to certificate dates 💖

okay so this is the X509_GET0_NOTBEFORE(3SSL) page from the OpenSSL manual, and it's literally all about the when is this cert valid fields. notBefore and notAfter, lastUpdate and nextUpdate, the whole calendar situation. dates are the main character here, no cap 🗓️✨

✨ NAME ✨

X509_get0_notBefore, X509_getm_notBefore, X509_get0_notAfter, X509_getm_notAfter, X509_set1_notBefore, X509_set1_notAfter, X509_ACERT_get0_notBefore, X509_ACERT_get0_notAfter, X509_ACERT_set1_notBefore, X509_ACERT_set1_notAfter, X509_CRL_get0_lastUpdate, X509_CRL_get0_nextUpdate, X509_CRL_set1_lastUpdate, X509_CRL_set1_nextUpdate — get or set certificate or CRL dates 🎀

🌸 SYNOPSIS 🌸

#include <openssl/x509.h>

const ASN1_TIME *X509_get0_notBefore(const X509 *x);
const ASN1_TIME *X509_get0_notAfter(const X509 *x);

ASN1_TIME *X509_getm_notBefore(const X509 *x);
ASN1_TIME *X509_getm_notAfter(const X509 *x);

int X509_set1_notBefore(X509 *x, const ASN1_TIME *tm);
int X509_set1_notAfter(X509 *x, const ASN1_TIME *tm);

const ASN1_GENERALIZEDTIME *X509_ACERT_get0_notBefore(const X509 *x);
const ASN1_GENERALIZEDTIME *X509_ACERT_get0_notAfter(const X509 *x);

int X509_ACERT_set1_notBefore(X509_ACERT *x, const ASN1_GENERALIZEDTIME *tm);
int X509_ACERT_set1_notAfter(X509_ACERT *x, const ASN1_GENERALIZEDTIME *tm);

const ASN1_TIME *X509_CRL_get0_lastUpdate(const X509_CRL *crl);
const ASN1_TIME *X509_CRL_get0_nextUpdate(const X509_CRL *crl);

int X509_CRL_set1_lastUpdate(X509_CRL *x, const ASN1_TIME *tm);
int X509_CRL_set1_nextUpdate(X509_CRL *x, const ASN1_TIME *tm);

🦋 DESCRIPTION 🦋

X509_get0_notBefore() and X509_get0_notAfter() hand you back the notBefore and notAfter fields of certificate x, respectively. and like… the thing they give you is an internal pointer — you do NOT free it after the call, bestie, that's not your pointer to free 🙅‍♀️. Also, x MUST NOT be NULL. periodt.

X509_getm_notBefore() and X509_getm_notAfter() are giving the same energy as X509_get0_notBefore() and X509_get0_notAfter() except they return a non-constant, mutable reference to the associated date field of the certificate. so like, you can poke at it 👀.

X509_set1_notBefore() and X509_set1_notAfter() set the notBefore and notAfter fields of x to tm. and hear me out: ownership of the tm you pass in is not transferred by these functions, so you still gotta free it up after the call. it's giving "borrowed, not adopted" 🫶.

X509_ACERT_get0_notBefore() and X509_ACERT_get0_notAfter() return the notBefore and notAfter fields of certificate x, respectively. the value returned is an internal pointer which must not be freed up after the call.

X509_ACERT_set1_notBefore() and X509_ACERT_set1_notAfter() set the notBefore and notAfter fields of x to tm. ownership of the passed parameter tm is not transferred by these functions, so it must be freed up after the call.

X509_CRL_get0_lastUpdate() and X509_CRL_get0_nextUpdate() return the lastUpdate and nextUpdate fields of crl. the value returned is an internal pointer which must not be freed up after the call. and if the nextUpdate field is absent from crl, then you get NULL back. (mood: the field simply isn't there 🫥)

X509_CRL_set1_lastUpdate() and X509_CRL_set1_nextUpdate() set the lastUpdate and nextUpdate fields of crl to tm. ownership of the passed parameter tm is not transferred by these functions, so it must be freed up after the call. for X509_CRL_set1_nextUpdate() the tm argument may be NULL, which implies removal of the optional nextUpdate field. yes bestie, NULL = delete, iconic behaviour 💅.

⭐ RETURN VALUES ⭐

  • X509_get0_notBefore(), X509_get0_notAfter() and X509_CRL_get0_lastUpdate() return a pointer to an ASN1_TIME structure.
  • X509_CRL_get0_lastUpdate() returns a pointer to an ASN1_TIME structure, or NULL if the lastUpdate field is absent.
  • X509_set1_notBefore(), X509_set1_notAfter(), X509_CRL_set1_lastUpdate() and X509_CRL_set1_nextUpdate() return 1 for success or 0 for failure.

🎀 NOTES 🎀

unlike the X509 and X509_CRL routines, the X509_ACERT routines use the ASN1_GENERALIZEDTIME format instead of ASN1_TIME for holding time data. so yeah, different time type, iykyk ⏰

🌈 SEE ALSO 🌈

d2i_X509(3), ASN1_GENERALIZEDTIME_check(3), ERR_get_error(3), X509_CRL_get0_by_serial(3), X509_get0_signature(3), X509_get_ext_d2i(3), X509_get_extension_flags(3), X509_get_pubkey(3), X509_get_subject_name(3), X509_NAME_add_entry_by_txt(3), X509_NAME_ENTRY_get_object(3), X509_NAME_get_index_by_NID(3), X509_NAME_print_ex(3), X509_new(3), X509_sign(3), X509V3_get_d2i(3), X509_verify_cert(3)

👑 HISTORY 👑

  • X509_get_notBefore() and X509_get_notAfter() were deprecated in OpenSSL 1.1.0. rip to them, they had a good run 💀
  • X509_ACERT_get0_notBefore(), X509_ACERT_get0_notAfter(), X509_ACERT_set1_notBefore(), X509_ACERT_set1_notAfter() were added in OpenSSL 3.4. fresh out the box ✨

Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

ok that's the whole page bestie, every flag every field every NULL accounted for, we ate and left no crumbs 🍓

stay hydrated, free your tm, and don't you dare free that internal pointer 💅

🌸 this has been the OpenSSL X509_GET0_NOTBEFORE(3SSL) page, version 4.0.3, dated 2026-09-29 — mwah, bye bestie 🦋💖

📦 where this page comes from