[M] Change in openvpn[master]: OpenSSL 4.0: Use X509_check_certificate_times instead of X509_cmp_time

Attention is currently required from: flichtenheld, mandree, plaisthos.

cron2 has posted comments on this change by plaisthos. ( http://gerrit.openvpn.net/c/openvpn/+/1595?usp=email )

Change subject: OpenSSL 4.0: Use X509_check_certificate_times instead of X509_cmp_time
......................................................................


Patch Set 5:

(3 comments)

Patchset:

PS5: 
After some quick discussion we didn't feel like doing another round - the API documentation says "these 4 error codes are possible" and it's hard to imagine anything else (a generic "EWEIRDFAILURE" can always be signalled as one of the two "cannot read <time> from cert" errors).  So we progress here, for now.


File src/openvpn/ssl_openssl.c:

http://gerrit.openvpn.net/c/openvpn/+/1595/comment/4abd9506_936c6580?usp=email :
PS3, Line 688:     if (error == X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD)
> Not sure whether that is bikeshedding, but should we maybe use a case statement here? Looks more app […]
Done


File src/openvpn/ssl_openssl.c:

http://gerrit.openvpn.net/c/openvpn/+/1595/comment/60f7cadb_7d8a7424?usp=email :
PS5, Line 724:     }
> The followup question to Frank's is whether there should be a default branch decoding other error va […]
Done



-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1595?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I6c2eda0e5bbb3a70b404f821e25ded81f0f5ddd5
Gerrit-Change-Number: 1595
Gerrit-PatchSet: 5
Gerrit-Owner: plaisthos <[email protected]>
Gerrit-Reviewer: cron2 <[email protected]>
Gerrit-Reviewer: flichtenheld <[email protected]>
Gerrit-CC: mandree <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
Gerrit-Attention: flichtenheld <[email protected]>
Gerrit-Attention: mandree <[email protected]>
Gerrit-Comment-Date: Fri, 17 Apr 2026 16:46:29 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: flichtenheld <[email protected]>
Comment-In-Reply-To: mandree <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel