---
name: "libressl-X509_get0_notBefore"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_get0_notBefore"
---

# libressl-X509\_get0\_notBefore(3)

get and set certificate and CRL validity dates

## NAME

**X509\_get0\_notBefore**, **X509\_get0\_notAfter**, **X509\_getm\_notBefore**, **X509\_getm\_notAfter**, **X509\_get\_notBefore**, **X509\_get\_notAfter**, **X509\_CRL\_get0\_lastUpdate**, **X509\_CRL\_get0\_nextUpdate**, **X509\_CRL\_get\_lastUpdate**, **X509\_CRL\_get\_nextUpdate**, **X509\_set1\_notBefore**, **X509\_set1\_notAfter**, **X509\_set\_notBefore**, **X509\_set\_notAfter**, **X509\_CRL\_set1\_lastUpdate**, **X509\_CRL\_set1\_nextUpdate**, **X509\_CRL\_set\_lastUpdate**, **X509\_CRL\_set\_nextUpdate** – get and set certificate and CRL validity dates

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*const* *ASN1\_TIME* *\**\

**X509\_get0\_notBefore**(*const X509 \*x*);

*const* *ASN1\_TIME* *\**\

**X509\_get0\_notAfter**(*const X509 \*x*);

*ASN1\_TIME* *\**\

**X509\_getm\_notBefore**(*const X509 \*x*);

*ASN1\_TIME* *\**\

**X509\_getm\_notAfter**(*const X509 \*x*);

*ASN1\_TIME* *\**\

**X509\_get\_notBefore**(*const X509 \*x*);

*ASN1\_TIME* *\**\

**X509\_get\_notAfter**(*const X509 \*x*);

*const* *ASN1\_TIME* *\**\

**X509\_CRL\_get0\_lastUpdate**(*const X509\_CRL \*crl*);

*const* *ASN1\_TIME* *\**\

**X509\_CRL\_get0\_nextUpdate**(*const X509\_CRL \*crl*);

*ASN1\_TIME* *\**\

**X509\_CRL\_get\_lastUpdate**(*X509\_CRL \*crl*);

*ASN1\_TIME* *\**\

**X509\_CRL\_get\_nextUpdate**(*X509\_CRL \*crl*);

*int*\

**X509\_set1\_notBefore**(*X509 \*x*, *const ASN1\_TIME \*tm*);

*int*\

**X509\_set1\_notAfter**(*X509 \*x*, *const ASN1\_TIME \*tm*);

*int*\

**X509\_set\_notBefore**(*X509 \*x*, *const ASN1\_TIME \*tm*);

*int*\

**X509\_set\_notAfter**(*X509 \*x*, *const ASN1\_TIME \*tm*);

*int*\

**X509\_CRL\_set1\_lastUpdate**(*X509\_CRL \*crl*, *const ASN1\_TIME \*tm*);

*int*\

**X509\_CRL\_set1\_nextUpdate**(*X509\_CRL \*crl*, *const ASN1\_TIME \*tm*);

*int*\

**X509\_CRL\_set\_lastUpdate**(*X509\_CRL \*crl*, *const ASN1\_TIME \*tm*);

*int*\

**X509\_CRL\_set\_nextUpdate**(*X509\_CRL \*crl*, *const ASN1\_TIME \*tm*);

## DESCRIPTION

**X509\_getm\_notBefore**() and **X509\_getm\_notAfter**() return pointers to the *notBefore* and *notAfter* fields of the validity period of the certificate *x*, respectively. **X509\_get\_notBefore**() and **X509\_get\_notAfter**() are deprecated aliases implemented as macros.

**X509\_get0\_notBefore**() and **X509\_get0\_notAfter**() are identical except for the const qualifier on the return type.

**X509\_CRL\_get0\_lastUpdate**() is misnamed in a confusing way: it returns a pointer to the *thisUpdate* field of the *crl*, indicating the time when this *crl* was issued.

**X509\_CRL\_get0\_nextUpdate**() returns a pointer to the *nextUpdate* field of the *crl*, indicating the time when issuing the subsequent CRL will be due.

**X509\_CRL\_get\_lastUpdate**() and **X509\_CRL\_get\_nextUpdate**() are deprecated and identical except for the const qualifier on the argument and on the return type.

**X509\_set1\_notBefore**(), **X509\_set1\_notAfter**(), **X509\_CRL\_set1\_lastUpdate**(), and **X509\_CRL\_set1\_nextUpdate**() set the *notBefore*, *notAfter*, *thisUpdate* (sic!), or *nextUpdate* field of *x* or *crl*, respectively, to a deep copy of *tm* and free the *ASN1\_TIME* value that they replace.

**X509\_set\_notBefore**(), **X509\_set\_notAfter**(), **X509\_CRL\_set\_lastUpdate**(), and **X509\_CRL\_set\_nextUpdate**() are deprecated aliases.

## RETURN VALUES

The **get** functions return internal pointers which must not be freed by the application, or NULL if the requested field is not available. They may crash with a NULL pointer access if *x* or *crl* is NULL.

The **set** functions return 1 on success or 0 on failure. They fail if *x* is NULL or does not contain a *validity* substructure, if *crl* is NULL, or if ASN1\_STRING\_dup(3) fails.

Except for some cases of ASN1\_STRING\_dup(3) failure, these functions do not support determining reasons for failure with ERR\_get\_error(3).

## SEE ALSO

ASN1\_TIME\_set(3), X509\_cmp\_time(3), X509\_CRL\_get0\_by\_serial(3), X509\_CRL\_new(3), X509\_get\_subject\_name(3), X509\_new(3), X509\_sign(3), X509\_VAL\_new(3), X509\_verify\_cert(3)

## HISTORY

**X509\_get\_notBefore**(), **X509\_get\_notAfter**(), **X509\_set\_notBefore**(), and **X509\_set\_notAfter**() first appeared in SSLeay 0.6.5 and have been available since OpenBSD 2.4.

**X509\_CRL\_get\_lastUpdate**() and **X509\_CRL\_get\_nextUpdate**() first appeared in OpenSSL 0.9.2 and have been available since OpenBSD 2.6.

**X509\_CRL\_set\_lastUpdate**() and **X509\_CRL\_set\_nextUpdate**() first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2.

The remaining functions first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 6.3.