From: Alexandr Nedvedicky <sashan@openssl.org>
Date: Mon, 2 Mar 2026 13:50:10 +0000 (+0100)
Subject: X509 returned by X509_REQ_to_X509() should not be (const ...)
X-Git-Tag: openssl-4.0.0-alpha1~50
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=70e71ac2ae18c719adae2875bc3d5b5353ca7bb8;p=thirdparty%2Fopenssl.git

X509 returned by X509_REQ_to_X509() should not be (const ...)

Fixes: 37436ba6977e "Constify X509_to_X509_REQ and X509_REQ_to_X509"

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Tue Mar  3 18:26:24 2026
(Merged from https://github.com/openssl/openssl/pull/30229)
---

diff --git a/crypto/x509/x509_r2x.c b/crypto/x509/x509_r2x.c
index 37a42b3cf8d..e59f86471f0 100644
--- a/crypto/x509/x509_r2x.c
+++ b/crypto/x509/x509_r2x.c
@@ -17,7 +17,7 @@
 #include <openssl/objects.h>
 #include <openssl/buffer.h>
 
-const X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
+X509 *X509_REQ_to_X509(const X509_REQ *r, int days, EVP_PKEY *pkey)
 {
     X509 *ret = NULL;
     X509_CINF *xi = NULL;
@@ -58,7 +58,7 @@ const X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
 
     if (!X509_sign(ret, pkey, EVP_md5()))
         goto err;
-    return (const X509 *)ret;
+    return ret;
 
 err:
     X509_free(ret);
diff --git a/include/openssl/x509.h.in b/include/openssl/x509.h.in
index 31ddf3ebec7..b5a104a3aa5 100644
--- a/include/openssl/x509.h.in
+++ b/include/openssl/x509.h.in
@@ -517,7 +517,7 @@ const char *X509_get_default_cert_file_env(void);
 const char *X509_get_default_private_dir(void);
 
 X509_REQ *X509_to_X509_REQ(const X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
-const X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey);
+X509 *X509_REQ_to_X509(const X509_REQ *r, int days, EVP_PKEY *pkey);
 
 DECLARE_ASN1_FUNCTIONS(X509_ALGOR)
 DECLARE_ASN1_ENCODE_FUNCTIONS(X509_ALGORS, X509_ALGORS, X509_ALGORS)