1.\" $OpenBSD: ASN1_TIME_set.3,v 1.23 2024/03/05 18:30:40 tb Exp $ 2.\" full merge up to: OpenSSL 3d0f1cb9 Jul 11 03:01:24 2017 +0800 3.\" selective merge up to: OpenSSL 24a535ea Sep 22 13:14:20 2020 +0100 4.\" 5.\" This file is a derived work. 6.\" The changes are covered by the following Copyright and license: 7.\" 8.\" Copyright (c) 2022 Ingo Schwarze <schwarze@openbsd.org> 9.\" Copyright (c) 2022 Bob Beck <beck@openbsd.org> 10.\" 11.\" Permission to use, copy, modify, and distribute this software for any 12.\" purpose with or without fee is hereby granted, provided that the above 13.\" copyright notice and this permission notice appear in all copies. 14.\" 15.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES 16.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 17.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR 18.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 19.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 20.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 21.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 22.\" 23.\" The original file was written by Dr. Stephen Henson <steve@openssl.org> 24.\" and Todd Short <tshort@akamai.com>. 25.\" Copyright (c) 2015, 2017 The OpenSSL Project. All rights reserved. 26.\" 27.\" Redistribution and use in source and binary forms, with or without 28.\" modification, are permitted provided that the following conditions 29.\" are met: 30.\" 31.\" 1. Redistributions of source code must retain the above copyright 32.\" notice, this list of conditions and the following disclaimer. 33.\" 34.\" 2. Redistributions in binary form must reproduce the above copyright 35.\" notice, this list of conditions and the following disclaimer in 36.\" the documentation and/or other materials provided with the 37.\" distribution. 38.\" 39.\" 3. All advertising materials mentioning features or use of this 40.\" software must display the following acknowledgment: 41.\" "This product includes software developed by the OpenSSL Project 42.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 43.\" 44.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 45.\" endorse or promote products derived from this software without 46.\" prior written permission. For written permission, please contact 47.\" openssl-core@openssl.org. 48.\" 49.\" 5. Products derived from this software may not be called "OpenSSL" 50.\" nor may "OpenSSL" appear in their names without prior written 51.\" permission of the OpenSSL Project. 52.\" 53.\" 6. Redistributions of any form whatsoever must retain the following 54.\" acknowledgment: 55.\" "This product includes software developed by the OpenSSL Project 56.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)" 57.\" 58.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 59.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 60.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 61.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 62.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 63.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 64.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 65.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 66.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 67.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 68.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 69.\" OF THE POSSIBILITY OF SUCH DAMAGE. 70.\" 71.Dd $Mdocdate: March 5 2024 $ 72.Dt ASN1_TIME_SET 3 73.Os 74.Sh NAME 75.Nm ASN1_TIME_set , 76.Nm ASN1_UTCTIME_set , 77.Nm ASN1_GENERALIZEDTIME_set , 78.Nm ASN1_TIME_adj , 79.Nm ASN1_UTCTIME_adj , 80.Nm ASN1_GENERALIZEDTIME_adj , 81.Nm ASN1_TIME_set_string , 82.Nm ASN1_TIME_set_string_X509 , 83.Nm ASN1_UTCTIME_set_string , 84.Nm ASN1_GENERALIZEDTIME_set_string , 85.Nm ASN1_TIME_normalize , 86.Nm ASN1_TIME_check , 87.Nm ASN1_UTCTIME_check , 88.Nm ASN1_GENERALIZEDTIME_check , 89.Nm ASN1_TIME_print , 90.Nm ASN1_UTCTIME_print , 91.Nm ASN1_GENERALIZEDTIME_print , 92.Nm ASN1_TIME_to_tm , 93.Nm ASN1_TIME_diff , 94.Nm ASN1_TIME_cmp_time_t , 95.Nm ASN1_UTCTIME_cmp_time_t , 96.Nm ASN1_TIME_compare , 97.Nm ASN1_TIME_to_generalizedtime , 98.Nm OPENSSL_gmtime , 99.Nm OPENSSL_timegm , 100.Nm OPENSSL_posix_to_tm , 101.Nm OPENSSL_tm_to_posix 102.Nd ASN.1 Time functions 103.Sh SYNOPSIS 104.In openssl/asn1.h 105.Ft ASN1_TIME * 106.Fo ASN1_TIME_set 107.Fa "ASN1_TIME *s" 108.Fa "time_t t" 109.Fc 110.Ft ASN1_UTCTIME * 111.Fo ASN1_UTCTIME_set 112.Fa "ASN1_UTCTIME *s" 113.Fa "time_t t" 114.Fc 115.Ft ASN1_GENERALIZEDTIME * 116.Fo ASN1_GENERALIZEDTIME_set 117.Fa "ASN1_GENERALIZEDTIME *s" 118.Fa "time_t t" 119.Fc 120.Ft ASN1_TIME * 121.Fo ASN1_TIME_adj 122.Fa "ASN1_TIME *s" 123.Fa "time_t t" 124.Fa "int offset_day" 125.Fa "long offset_sec" 126.Fc 127.Ft ASN1_UTCTIME * 128.Fo ASN1_UTCTIME_adj 129.Fa "ASN1_UTCTIME *s" 130.Fa "time_t t" 131.Fa "int offset_day" 132.Fa "long offset_sec" 133.Fc 134.Ft ASN1_GENERALIZEDTIME * 135.Fo ASN1_GENERALIZEDTIME_adj 136.Fa "ASN1_GENERALIZEDTIME *s" 137.Fa "time_t t" 138.Fa "int offset_day" 139.Fa "long offset_sec" 140.Fc 141.Ft int 142.Fo ASN1_TIME_set_string 143.Fa "ASN1_TIME *s" 144.Fa "const char *str" 145.Fc 146.Ft int 147.Fo ASN1_TIME_set_string_X509 148.Fa "ASN1_TIME *s" 149.Fa "const char *str" 150.Fc 151.Ft int 152.Fo ASN1_UTCTIME_set_string 153.Fa "ASN1_UTCTIME *s" 154.Fa "const char *str" 155.Fc 156.Ft int 157.Fo ASN1_GENERALIZEDTIME_set_string 158.Fa "ASN1_GENERALIZEDTIME *s" 159.Fa "const char *str" 160.Fc 161.Ft int 162.Fo ASN1_TIME_normalize 163.Fa "ASN1_TIME *s" 164.Fc 165.Ft int 166.Fo ASN1_TIME_check 167.Fa "const ASN1_TIME *t" 168.Fc 169.Ft int 170.Fo ASN1_UTCTIME_check 171.Fa "const ASN1_UTCTIME *t" 172.Fc 173.Ft int 174.Fo ASN1_GENERALIZEDTIME_check 175.Fa "const ASN1_GENERALIZEDTIME *t" 176.Fc 177.Ft int 178.Fo ASN1_TIME_print 179.Fa "BIO *b" 180.Fa "const ASN1_TIME *s" 181.Fc 182.Ft int 183.Fo ASN1_UTCTIME_print 184.Fa "BIO *b" 185.Fa "const ASN1_UTCTIME *s" 186.Fc 187.Ft int 188.Fo ASN1_GENERALIZEDTIME_print 189.Fa "BIO *b" 190.Fa "const ASN1_GENERALIZEDTIME *s" 191.Fc 192.Ft int 193.Fo ASN1_TIME_to_tm 194.Fa "const ASN1_TIME *s" 195.Fa "struct tm *tm" 196.Fc 197.Ft int 198.Fo ASN1_TIME_diff 199.Fa "int *pday" 200.Fa "int *psec" 201.Fa "const ASN1_TIME *from" 202.Fa "const ASN1_TIME *to" 203.Fc 204.Ft int 205.Fo ASN1_TIME_cmp_time_t 206.Fa "const ASN1_TIME *s" 207.Fa "time_t t" 208.Fc 209.Ft int 210.Fo ASN1_UTCTIME_cmp_time_t 211.Fa "const ASN1_UTCTIME *s" 212.Fa "time_t t" 213.Fc 214.Ft int 215.Fo ASN1_TIME_compare 216.Fa "const ASN1_TIME *s" 217.Fa "const ASN1_TIME *t" 218.Fc 219.Ft ASN1_GENERALIZEDTIME * 220.Fo ASN1_TIME_to_generalizedtime 221.Fa "const ASN1_TIME *t" 222.Fa "ASN1_GENERALIZEDTIME **out" 223.Fc 224.In openssl/crypto.h 225.Ft struct tm * 226.Fo OPENSSL_gmtime 227.Fa "const time_t *time" 228.Fa "struct tm *out_tm" 229.Fc 230.In openssl/posix_time.h 231.Ft int 232.Fo OPENSSL_timegm 233.Fa "const struct tm *tm" 234.Fa "time_t *out_time" 235.Fc 236.Ft int 237.Fo OPENSSL_posix_to_tm 238.Fa "int64_t time" 239.Fa "struct tm *out_tm" 240.Fc 241.Ft int 242.Fo OPENSSL_tm_to_posix 243.Fa "struct tm *t_tm" 244.Fa "int64_t *out" 245.Fc 246.Sh DESCRIPTION 247An 248.Vt ASN1_TIME 249object is a shallow wrapper around a string containing an ASN.1 250.Vt Time 251value in the restricted format valid in X.509 certificates. 252An 253.Vt ASN1_TIME 254object is either an 255.Vt ASN1_UTCTIME 256object containing a string of the format 257.Ar YYMMDDHHMMSS Ns Cm Z 258which is valid for the years 1950 to 2049, or an 259.Vt ASN1_GENERALIZEDTIME 260object containing a string of the format 261.Ar YYYYMMDDHHMMSS Ns Cm Z 262which is valid for the years 0000 to 1949 and 2050 to 9999. 263In both cases, the mandatory suffix 264.Sq Cm Z 265represents the GMT time zone. 266LibreSSL by design does not support the full syntax of ASN.1 times. 267In particular, it neither supports fractional seconds 268nor any other time zone. 269.Pp 270The functions 271.Fn ASN1_TIME_set , 272.Fn ASN1_UTCTIME_set , 273and 274.Fn ASN1_GENERALIZEDTIME_set 275set the time object 276.Fa s 277to the time represented by the 278.Vt time_t 279value 280.Fa t . 281If 282.Fa s 283is 284.Dv NULL , 285a new time object is allocated and returned. 286.Pp 287The functions 288.Fn ASN1_TIME_adj , 289.Fn ASN1_UTCTIME_adj , 290and 291.Fn ASN1_GENERALIZEDTIME_adj 292set the time object 293.Fa s 294to the time represented by the time 295.Fa offset_day 296and 297.Fa offset_sec 298after the 299.Vt time_t 300value 301.Fa t . 302The values of 303.Fa offset_day 304or 305.Fa offset_sec 306can be negative to set a time before 307.Fa t . 308The 309.Fa offset_sec 310value can also exceed the number of seconds in a day. 311If 312.Fa s 313is 314.Dv NULL , 315a new time object is allocated and returned. 316.Pp 317.Fn ASN1_TIME_adj 318may change the type from 319.Vt ASN1_GENERALIZEDTIME 320to 321.Vt ASN1_UTCTIME 322or vice versa depending on the resulting year. 323The functions 324.Fn ASN1_UTCTIME_adj 325and 326.Fn ASN1_GENERALIZEDTIME_adj 327do not modify the type of the return object. 328.Pp 329The functions 330.Fn ASN1_TIME_set_string , 331.Fn ASN1_TIME_set_string_X509 , 332.Fn ASN1_UTCTIME_set_string , 333and 334.Fn ASN1_GENERALIZEDTIME_set_string 335set the time object 336.Fa s 337to the time string 338.Fa str , 339which must be in appropriate ASN.1 time format: 340YYMMDDHHMMSSZ for 341.Vt ASN1_UTCTIME , 342YYYYMMDDHHMMSSZ for 343.Vt ASN1_GENERALIZEDTIME , 344or either of the two for 345.Vt ASN1_TIME . 346The string 347.Fa str 348is copied into 349.Fa s . 350If 351.Fa s 352is 353.Dv NULL , 354these functions only perform a format check on 355.Fa str . 356.Pp 357In LibreSSL, 358.Fn ASN1_TIME_set_string 359and 360.Fn ASN1_TIME_set_string_X509 361behave identically and always set the time object 362to a valid value to use in an X.509 certificate. 363.Fn ASN1_GENERALIZEDTIME_set_string 364may encode a time string that is not valid in an X.509 certificate. 365.Pp 366The function 367.Fn ASN1_TIME_normalize 368converts an 369.Vt ASN1_GENERALIZEDTIME 370into a time value that can be used in a certificate 371by changing it to an 372.Vt ASN1_UTCTIME 373if possible. 374It has no effect on an 375.Vt ASN1_UTCTIME . 376.Pp 377The functions 378.Fn ASN1_TIME_check , 379.Fn ASN1_UTCTIME_check , 380and 381.Fn ASN1_GENERALIZEDTIME_check 382check the syntax of the time string contained in the object 383.Fa s . 384.Pp 385The functions 386.Fn ASN1_TIME_print , 387.Fn ASN1_UTCTIME_print , 388and 389.Fn ASN1_GENERALIZEDTIME_print 390print out the time 391.Fa s 392to 393.Vt BIO 394.Fa b 395in human readable format. 396It will be of the format MMM DD HH:MM:SS YYYY [GMT], for example "Feb 3 39700:55:52 2015 GMT". 398It does not include a newline. 399If the time string has an invalid format, 400it prints out "Bad time value" and returns an error. 401.Pp 402The function 403.Fn ASN1_TIME_to_tm 404converts the time 405.Fa s 406to the standard 407.Vt tm 408structure. 409If 410.Fa s 411is 412.Dv NULL , 413then the current time is converted. 414The output time is always in the GMT time zone. 415The 416.Fa tm_sec , tm_min , tm_hour , tm_mday , tm_mon , 417and 418.Fa tm_year 419fields of the 420.Vt tm 421structure are set to the proper values, 422whereas all other fields are set to 0. 423If 424.Fa tm 425is 426.Dv NULL , 427this function performs a format check on 428.Fa s 429only. 430.Pp 431The function 432.Fn ASN1_TIME_diff 433sets 434.Pf * Fa pday 435and 436.Pf * Fa psec 437to the time difference between 438.Fa from 439and 440.Fa to . 441If 442.Fa to 443represents a time later than 444.Fa from , 445then one or both (depending on the time difference) of 446.Pf * Fa pday 447and 448.Pf * Fa psec 449will be positive. 450If 451.Fa to 452represents a time earlier than 453.Fa from , 454then one or both of 455.Pf * Fa pday 456and 457.Pf * Fa psec 458will be negative. 459If 460.Fa to 461and 462.Fa from 463represent the same time, then 464.Pf * Fa pday 465and 466.Pf * Fa psec 467will both be zero. 468If both 469.Pf * Fa pday 470and 471.Pf * Fa psec 472are nonzero, they will always have the same sign. 473The value of 474.Pf * Fa psec 475will always be less than the number of seconds in a day. 476If 477.Fa from 478or 479.Fa to 480is 481.Dv NULL , 482the current time is used. 483.Pp 484The functions 485.Fn ASN1_TIME_cmp_time_t , 486.Fn ASN1_UTCTIME_cmp_time_t , 487and 488.Fn ASN1_TIME_compare 489compare the two times represented by 490.Fa s 491and 492.Fa t . 493.Pp 494The function 495.Fn ASN1_TIME_to_generalizedtime 496converts the 497.Vt ASN1_TIME 498.Fa t 499to an 500.Vt ASN1_GENERALIZEDTIME , 501regardless of year. 502If either 503.Fa out 504or 505.Pf * Fa out 506is 507.Dv NULL , 508then a new object is allocated and must be freed after use. 509.Pp 510The 511.Vt ASN1_TIME , 512.Vt ASN1_UTCTIME , 513and 514.Vt ASN1_GENERALIZEDTIME 515objects are represented as 516.Vt ASN1_STRING 517objects internally and can be freed using 518.Xr ASN1_STRING_free 3 . 519.Pp 520It is recommended that 521.Vt ASN1_TIME 522functions be used instead of 523.Vt ASN1_UTCTIME 524or 525.Vt ASN1_GENERALIZEDTIME 526functions because the 527.Vt ASN1_UTCTIME 528and 529.Vt ASN1_GENERALIZEDTIME 530functions act only on that specific time format, while the 531.Vt ASN1_TIME 532functions operate on either format. 533.Pp 534.Fn OPENSSL_gmtime 535converts a time_t value in 536.Fa time 537to a struct tm in 538.Fa out_tm 539and also returns the struct passed in on success. 540.Pp 541.Fn OPENSSL_timegm 542converts a time structure in UTC time in 543.Fa tm 544to a time_t value in 545.Fa out_time . 546.Pp 547.Fn OPENSSL_posix_to_tm 548converts an 549.Vt int64_t 550POSIX time value in 551.Fa time , 552which must be in the range of year 0 to 9999, 553to a broken out time value in 554.Fa tm . 555.Pp 556.Fn OPENSSL_tm_to_posix 557converts a time value between the years 0 and 9999 in 558.Fa tm 559to a POSIX time value in 560.Fa out . 561.Sh RETURN VALUES 562.Fn ASN1_TIME_set , 563.Fn ASN1_UTCTIME_set , 564.Fn ASN1_GENERALIZEDTIME_set , 565.Fn ASN1_TIME_adj , 566.Fn ASN1_UTCTIME_adj , 567.Fn ASN1_GENERALIZEDTIME_adj , 568and 569.Fn ASN1_TIME_to_generalizedtime 570return a pointer to a time object or 571.Dv NULL 572if an error occurred. 573.Pp 574.Fn ASN1_TIME_set_string , 575.Fn ASN1_TIME_set_string_X509 , 576.Fn ASN1_UTCTIME_set_string , 577and 578.Fn ASN1_GENERALIZEDTIME_set_string 579return 1 if the time value is successfully set or 0 otherwise. 580.Pp 581.Fn ASN1_TIME_normalize 582returns 1 on success or 0 on error. 583.Pp 584.Fn ASN1_TIME_check , 585.Fn ASN1_UTCTIME_check , 586and 587.Fn ASN1_GENERALIZEDTIME_check 588return 1 if the time string contained in the object is syntactically 589correct or 0 otherwise. 590.Pp 591.Fn ASN1_TIME_print , 592.Fn ASN1_UTCTIME_print , 593and 594.Fn ASN1_GENERALIZEDTIME_print 595return 1 if the time is successfully printed or 0 if an error 596occurred (I/O error or invalid time format). 597.Pp 598.Fn ASN1_TIME_to_tm 599returns 1 if the time is successfully parsed 600or 0 if an error occurred, usually due to an invalid time format. 601.Pp 602.Fn ASN1_TIME_diff 603returns 1 for success or 0 for failure. 604It can for example fail if a time string passed in has invalid syntax. 605.Pp 606.Fn ASN1_TIME_cmp_time_t , 607.Fn ASN1_UTCTIME_cmp_time_t , 608and 609.Fn ASN1_TIME_compare 610return \-1 if 611.Fa s 612is earlier than 613.Fa t , 6140 if both are equal, 1 if 615.Fa s 616is later than 617.Fa t , 618or \-2 on error. 619.Pp 620.Fn OPENSSL_timegm 621returns 1 for success or 0 for failure. 622It can fail if the time is not representable in a time_t, 623or falls outside the range allowed in RFC 5280 times. 624.Pp 625.Fn OPENSSL_gmtime 626returns 627.Fa out_tm 628on success or NULL for failure. 629It can fail if the time is not representable in a struct tm, 630or falls outside the range allowed in RFC 5280 times. 631.Pp 632.Fn OPENSSL_posix_to_tm 633and 634.Fn OPENSSL_tm_to_posix 635return 1 for success or 0 on failure. 636It is a failure if the year is less than 0 or more than 9999. 637.Sh EXAMPLES 638Set a time object to one hour after the current time and print it 639out: 640.Bd -literal -offset indent 641#include <time.h> 642#include <openssl/asn1.h> 643 644ASN1_TIME *asn1_time; 645time_t t; 646BIO *b; 647 648t = time(NULL); 649asn1_time = ASN1_TIME_adj(NULL, t, 0, 60 * 60); 650b = BIO_new_fp(stdout, BIO_NOCLOSE); 651if (asn1_time != NULL) { 652 ASN1_TIME_print(b, asn1_time); 653 BIO_printf(b, "\en"); 654} else { 655 BIO_printf(b, "Time out of range or un-representable\en"); 656} 657ASN1_STRING_free(asn1_time); 658BIO_free(b); 659.Ed 660.Sh SEE ALSO 661.Xr ASN1_TIME_new 3 , 662.Xr X509_cmp_time 3 663.Sh STANDARDS 664The usage of the ASN.1 665.Vt Time , 666.Vt UTCTime , 667and 668.Vt GeneralizedTime 669data types in X.509 certificates is specified in 670RFC 5280, Internet X.509 Public Key Infrastructure Certificate and 671Certificate Revocation List (CRL) Profile, 672section 4.1.2.5 (TBS Certificate Validity). 673.Sh HISTORY 674.Fn ASN1_UTCTIME_check 675and 676.Fn ASN1_UTCTIME_print 677first appeared in SSLeay 0.5.1. 678.Fn ASN1_UTCTIME_set 679first appeared in SSLeay 0.6.0. 680.Fn ASN1_UTCTIME_set_string 681first appeared in SSLeay 0.9.0. 682All these functions have been available since 683.Ox 2.4 . 684.Pp 685.Fn ASN1_TIME_set , 686.Fn ASN1_GENERALIZEDTIME_set , 687.Fn ASN1_GENERALIZEDTIME_set_string , 688.Fn ASN1_GENERALIZEDTIME_check , 689.Fn ASN1_TIME_print , 690and 691.Fn ASN1_GENERALIZEDTIME_print 692first appeared in OpenSSL 0.9.2b and have been available since 693.Ox 2.6 . 694.Pp 695.Fn ASN1_UTCTIME_cmp_time_t 696first appeared in OpenSSL 0.9.6 and has been available since 697.Ox 2.9 . 698.Pp 699.Fn ASN1_TIME_check 700and 701.Fn ASN1_TIME_to_generalizedtime 702first appeared in OpenSSL 0.9.7 and have been available since 703.Ox 3.2 . 704.Pp 705.Fn ASN1_TIME_adj , 706.Fn ASN1_UTCTIME_adj , 707.Fn ASN1_GENERALIZEDTIME_adj , 708and 709.Fn ASN1_TIME_set_string 710first appeared in OpenSSL 1.0.0 and have been available since 711.Ox 4.9 . 712.Pp 713.Fn ASN1_TIME_diff 714first appeared in OpenSSL 1.0.2 and have been available since 715.Ox 7.1 . 716.Pp 717.Fn ASN1_TIME_set_string_X509 , 718.Fn ASN1_TIME_normalize , 719.Fn ASN1_TIME_to_tm , 720.Fn ASN1_TIME_cmp_time_t , 721and 722.Fn ASN1_TIME_compare 723first appeared in OpenSSL 1.1.1 and have been available since 724.Ox 7.2 . 725.Pp 726.Fn OPENSSL_gmtime 727first appeared in OpenSSL 0.9.7. 728.Fn OPENSSL_timegm , 729.Fn OPENSSL_posix_to_tm , 730and 731.Fn OPENSSL_tm_to_posix 732first appeared in BoringSSL; 733all these functions have been available since 734.Ox 7.5 . 735.Sh CAVEATS 736Some applications add offset times directly to a 737.Vt time_t 738value and pass the results to 739.Fn ASN1_TIME_set 740(or equivalent). 741This can cause problems as the 742.Vt time_t 743value can overflow on some systems resulting in unexpected results. 744New applications should use 745.Fn ASN1_TIME_adj 746instead and pass the offset value in the 747.Fa offset_sec 748and 749.Fa offset_day 750parameters instead of directly manipulating a 751.Vt time_t 752value. 753