[PATCH applied] Re: OpenSSL 4.0: Use X509_check_certificate_times instead of X509_cmp_time

So, for "non openssl 4.0" builds, this patch has no effect.  With 4.0, we
get compile warnings without this patch, and it compiles fine with it -
and for a profile I had around with an expired cert, it shows the expected
message.  All the error codes that are documented as possible return
values are handled, though I cannot test this (I guess you need to produce
a corrupt cert for two of them).

As for "add a default clause for yet-unknown error messages", we decided
against (because there are not really any other ways this could fail,
and even if, it's just a helper function to tell users that their 
certificate lifetime is in conflict with local date, which might or might
not lead to problems connecting).

Your patch has been applied to the master and release/2.7 branch.

commit 353ec724f9bc1dceb36760eceee0a128e140044c (master)
commit 8747fcf641214d4f05de53f9db825f396049e3d3 (release/2.7)
Author: Arne Schwabe
Date:   Fri Apr 17 18:46:38 2026 +0200

     OpenSSL 4.0: Use X509_check_certificate_times instead of X509_cmp_time

     Signed-off-by: Arne Schwabe <[email protected]>
     Acked-by: Gert Doering <[email protected]>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1595
     Message-Id: <[email protected]>
     URL: https://www.mail-archive.com/[email protected]/msg36651.html
     Signed-off-by: Gert Doering <[email protected]>


--
kind regards,

Gert Doering