openssl/apps/x509.c, branch dependabot/github_actions/actions/setup-python-7

Deprecate the X509_check_{email,host,ip,ip_asc} family of functions

2026-05-11T00:05:22Z

Our own documentation for quite some time has indicated that you should call X509_verify_cert() instead of using these. Actually deprecate them and make apps not use the now deprecated functions. Resolves: https://github.com/openssl/project/issues/1899 References: https://github.com/openssl/project/issues/1897 Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov Reviewed-by: Norbert Pocs MergeDate: Mon May 11 00:08:33 2026 (Merged from https://github.com/openssl/openssl/pull/30403)

apps : enforce command-line parameter checking.

2026-04-13T09:30:19Z

Improve 'verify' option help messages. integer value parsing formats are: - 'n' is any integer - 'N' is a non-negative integer (i.e. value >= 0) - 'p' is a positive integer (i.e. value > 0) Reviewed-by: Eugene Syromiatnikov Reviewed-by: Paul Dale Reviewed-by: Frederik Wedel-Heinen MergeDate: Mon Apr 13 09:30:22 2026 (Merged from https://github.com/openssl/openssl/pull/30476)

apps: remove atoi() calls.

2026-04-13T09:29:19Z

Related to #8216 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Paul Dale Reviewed-by: Frederik Wedel-Heinen MergeDate: Mon Apr 13 09:30:21 2026 (Merged from https://github.com/openssl/openssl/pull/30476)

Copyright year updates

2026-03-10T14:37:52Z

Reviewed-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Mar 10 14:37:54 2026 Release: yes

Improved handling of AKID/SKID extensions in CSRs and certs

2026-02-28T15:17:57Z

With the advent of the new AKID and SKID value syntax: - subjectKeyIdentifier = none - authorityKeyIdentifier = none the resulting extensions are not directly suppressed, instead they are parsed respectively as an empty OCTET STRING or an empty SEQUENCE. There was new code in "apps/" to then drop the extension when signing certificates, but this did not address applications that sign certificates via the API, nor did it avoid adding these in CSRs. We now drop these specific empty extensions from both certificates and CSRs as part of X509v3_add_ext(), with the parsed extension never added to the extension stack. This means that in the "apps" the default "hash" or "keyid, issuer" values must now be created first, with config settings and command-line options applied after replacing the default as requested (including "none" to suppress the extensions if desired). If somehow an application manages to construct a TBS cert or CSR with a pending empty SKID or AKID extension, an error is raised and the TBS is not signed. When no SKID is present in a self-signed cert, attempts to force an AKID keyid need to fail, rather than produce an AKID that will never match. Similarly, when issuer cert == subject cert (same object in memory), but the issuer key is not the subject key (forced signing key), there is no way to infer the unknown issuer's name or serial number, so, with "issuer:always" we must fail, rather than record the subject's own issuer name and serial. New "keyid:nonss" and "issuer:nonss" syntax is now supported, which allows either part of the AKID to be conditional on the certificate not being self-signed. In the case if "issuer:nonss" this is also conditional on there being no non-empty issuer keyid. To force inclusion of issuer+serial in the AKID use "issuer:always". Reviewed-by: Matt Caswell Reviewed-by: Neil Horman MergeDate: Sat Feb 28 15:22:47 2026 (Merged from https://github.com/openssl/openssl/pull/29057)

Constify X509_STORE_CTX functions invoving X509 *

2026-02-25T10:22:57Z

X509_STORE_CTX *ctx, const X509 *x); X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, const X509 *x); int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *trust_store, const X509 *target, STACK_OF(X509) *untrusted); const X509 *X509_STORE_CTX_get0_cert(const X509_STORE_CTX *ctx); const X509 *X509_STORE_CTX_get_current_cert(const X509_STORE_CTX *ctx); const X509 *X509_STORE_CTX_get0_current_issuer(const X509_STORE_CTX *ctx); void X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx, const X509 *target); For #30052 Reviewed-by: Neil Horman Reviewed-by: Paul Dale MergeDate: Wed Feb 25 10:24:15 2026 (Merged from https://github.com/openssl/openssl/pull/30076)

Make ASN1_STRING opaque

2026-02-25T10:12:51Z

This laudable goal, should it land, will be followed with an issue raised to eat our own dogfood and find every file with added to it in this commit, and change to the appropriate accessors, which should be possible in most places we aren't actually implementing things that change the values Fixes: https://github.com/openssl/openssl/issues/29860 Reviewed-by: Neil Horman Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz MergeDate: Wed Feb 25 10:14:57 2026 (Merged from https://github.com/openssl/openssl/pull/29862)

Constify X509_get_ext() and friends..

2026-02-24T18:53:17Z

These all took const, but returned non const, they should return const. This then triggers constifying of a whole class of get_ext() functions. Part of #28654 and #29117 Fixes: openssl/project#1779 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Neil Horman MergeDate: Tue Feb 24 18:53:25 2026 (Merged from https://github.com/openssl/openssl/pull/29465)

Constify more X509 arguments and return values

2026-02-24T16:32:35Z

X509_get0_distinguishing_id X509_keyid_get0 X509_alias_get0 X509_CRL_get0_by_cert X509_issuer_name_hash X509_issuer_name_hash_old X509_subject_name_hash_old are all const corrected And PKCS12_add_localkeyid as a result X509_getm_notBefore X509_getm_notAfter= are const "corrected" by making their argument non-const Reviewed-by: Eugene Syromiatnikov Reviewed-by: Paul Dale Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Neil Horman MergeDate: Tue Feb 24 16:32:45 2026 (Merged from https://github.com/openssl/openssl/pull/30036)

Fix the uses of X509_check_certificate_times

2026-02-23T15:43:13Z

The "error" parameter to 'X509_check_certificate_times' gets an X509 error value, which isn't a OpenSSL ERR reason code. Unfortunately, this was conflated. This restores the behaviour in the places of conflation to something similar enough to what was done before 'X509_check_certificate_times' was implemented. Reviewed-by: David von Oheimb Reviewed-by: Tomas Mraz Reviewed-by: Neil Horman MergeDate: Mon Feb 23 15:43:21 2026 (Merged from https://github.com/openssl/openssl/pull/30088)