openssl/apps/ca.c, branch openssl-3.4.5

3.4-POST-CLANG-FORMAT-WEBKIT

2025-12-09T13:48:07Z

Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman Reviewed-by: Norbert Pocs (Merged from https://github.com/openssl/openssl/pull/29260)

Copyright year updates

2024-09-05T07:35:49Z

Reviewed-by: Neil Horman Release: yes

apps: ca,req,x509: Add explicit start and end dates options

2024-04-09T18:13:31Z

- Added options `-not_before` (start date) and `-not-after` (end date) for explicit setting of the validity period of a certificate in the apps `ca`, `req` and `x509` - The new options accept time strings or "today" - In app `ca`, use the new options as aliases of the already existing options `-startdate` and `-enddate` - When used in apps `req` and `x509`, the end date must be >= the start date, in app `ca` end date < start date is also accepted - In any case, `-not-after` overrides the `-days` option - Added helper function `check_cert_time_string` to validate given certificate time strings - Use the new helper function in apps `ca`, `req` and `x509` - Moved redundant code for time string checking into `set_cert_times` helper function. - Added tests for explicit start and end dates in apps `req` and `x509` - test: Added auxiliary functions for parsing fields from `-text` formatted output to `tconversion.pl` - CHANGES: Added to new section 3.4 Signed-off-by: Stephan Wurm Reviewed-by: David von Oheimb Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/21716)

Copyright year updates

2023-09-07T08:59:15Z

Reviewed-by: Richard Levitte Release: yes

Correct spelling of database

2023-07-27T14:12:18Z

Apply normal sentence case to db update message CLA: trivial Reviewed-by: Hugo Landau Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Tom Cosgrove Reviewed-by: Todd Short (Merged from https://github.com/openssl/openssl/pull/21535)

apps/ca.c: Handle EVP_PKEY_get_default_digest_name() returning 1 with "UNDEF"

2023-06-15T12:03:57Z

EVP_PKEY_get_default_digest_name() may return 1 with the returned digest name "UNDEF". This case hasn't been documented, and the meaning has been left undefined, until now. Reviewed-by: Todd Short Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/20460)

APPS: replace awkward and error-prone pattern by calls to new app_conf_try_number()

2023-05-25T07:04:35Z

Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: David von Oheimb (Merged from https://github.com/openssl/openssl/pull/20971)

APPS: replace awkward and error-prone pattern by calls to new app_conf_try_string()

2023-05-25T07:04:35Z

Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: David von Oheimb (Merged from https://github.com/openssl/openssl/pull/20971)

APPS/ca: remove spurious errors when certain config file entries are not provided

2023-05-25T07:04:35Z

Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: David von Oheimb (Merged from https://github.com/openssl/openssl/pull/20971)

apps: silent warning when loading CSR files with vfyopt option

2023-05-03T07:48:17Z

When verifying or signing a CSR file with the -vfyopt option, a warning message similar to the following will appear: Warning: CSR self-signature does not match the contents This happens especially when the SM2 algorithm is used and the distid parameter is added. Pass the vfyopts parameter to the do_X509_REQ_verify() function to eliminate the warning message. Signed-off-by: Tianjia Zhang Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/20799)