From 3e30b785e8c6784278216961f1901a480226388e Mon Sep 17 00:00:00 2001 From: Simon Pinches Date: Wed, 7 Oct 2026 14:52:35 +0200 Subject: [PATCH] Replace X509_cmp_time, deprecated in OpenSSL 4.0 X509_cmp_time is deprecated in OpenSSL 4.0, which breaks the -Werror build of udaClientSSL.cpp (e.g. with Homebrew's openssl on macOS). Use ASN1_TIME_cmp_time_t (OpenSSL >= 1.1.1) instead. It returns 0 when the times are equal and -2 on error, so the not-before checks now test for 'later or error', keeping the previous behaviour: certificates whose validity starts exactly now are accepted, and unparsable dates are rejected. --- source/authentication/udaClientSSL.cpp | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/source/authentication/udaClientSSL.cpp b/source/authentication/udaClientSSL.cpp index ee1845b9..0aa64613 100755 --- a/source/authentication/udaClientSSL.cpp +++ b/source/authentication/udaClientSSL.cpp @@ -290,7 +290,10 @@ int configureUdaClientSSLContext(const HostData* host) UDA_LOG(UDA_LOG_DEBUG, "Client X509 not before: %s\n", before_string.c_str()); int rc = 0; - if ((rc = X509_cmp_time(before, ¤t_time)) >= 0) { + // ASN1_TIME_cmp_time_t: -1/0/1 if earlier/equal/later than current_time, -2 on error + // (replaces X509_cmp_time, deprecated in OpenSSL 4.0) + rc = ASN1_TIME_cmp_time_t(before, current_time); + if (rc > 0 || rc == -2) { // Not Before is after Now! X509_free(clientCert); UDA_LOG(UDA_LOG_DEBUG, "Current Time : %s\n", c_time_string); @@ -302,7 +305,7 @@ int configureUdaClientSSLContext(const HostData* host) std::string after_string = to_string(after); UDA_LOG(UDA_LOG_DEBUG, "Client X509 not after : %s\n", after_string.c_str()); - if ((rc = X509_cmp_time(after, ¤t_time)) <= 0) {// Not After is before Now! + if ((rc = ASN1_TIME_cmp_time_t(after, current_time)) <= 0) {// Not After is before Now (or error)! X509_free(clientCert); UDA_LOG(UDA_LOG_DEBUG, "Current Time : %s\n", c_time_string); UDA_LOG(UDA_LOG_DEBUG, "Client X509 not after date is after the current date!\n"); @@ -418,7 +421,10 @@ int startUdaClientSSL() std::string before_string = to_string(before); UDA_LOG(UDA_LOG_DEBUG, "Server X509 not before: %s\n", before_string.c_str()); - if ((rc = X509_cmp_time(before, ¤t_time)) >= 0) {// Not Before is after Now! + // ASN1_TIME_cmp_time_t: -1/0/1 if earlier/equal/later than current_time, -2 on error + // (replaces X509_cmp_time, deprecated in OpenSSL 4.0) + rc = ASN1_TIME_cmp_time_t(before, current_time); + if (rc > 0 || rc == -2) {// Not Before is after Now! X509_free(peer); UDA_LOG(UDA_LOG_DEBUG, "Current Time : %s\n", c_time_string); UDA_LOG(UDA_LOG_DEBUG, "Server X509 not before date is before the current date!\n"); @@ -430,7 +436,7 @@ int startUdaClientSSL() std::string after_string = to_string(after); UDA_LOG(UDA_LOG_DEBUG, "Server X509 not after : %s\n", after_string.c_str()); - if ((rc = X509_cmp_time(after, ¤t_time)) <= 0) {// Not After is before Now! + if ((rc = ASN1_TIME_cmp_time_t(after, current_time)) <= 0) {// Not After is before Now (or error)! X509_free(peer); UDA_LOG(UDA_LOG_DEBUG, "Current Time : %s\n", c_time_string); UDA_LOG(UDA_LOG_DEBUG, "Server X509 not after date is after the current date!\n");