errors: fix stale string overrides in openssl.txt for renamed SSL error codes

Commit b3d26e438a ("merge feature/removesslv3", PR #29338) renamed SSL3
error codes to TLS equivalents and updated the string descriptions in
crypto/ssl_err.c (e.g. from "ssl/tls alert bad certificate" to
"tls alert bad certificate"), but did not update the corresponding
strings in crypto/err/openssl.txt.

This caused a latent divergence: running mkerr.pl -rebuild would
regenerate ssl_err.c with the old openssl.txt strings, undoing the
intentional name cleanup. Similarly, adding any new SSL error code
triggers a full SSL regeneration that would revert the strings and
reorder entries to their correct alphabetical positions, producing
spurious changes unrelated to the new code.

Update openssl.txt to match the strings already in ssl_err.c, which
also happen to be the auto-generated strings derived from the reason
code names. Regenerate ssl_err.c and sslerr.h with the correct
alphabetical ordering so that future make update runs are idempotent:
adding and removing a new SSL error code now produces only the expected
changes to the generated files, with no side-effect reordering or
string reversions.

Fixes: b3d26e438a ("Rename SSL3 error codes to TLS equivalents")
Signed-off-by: Todd Short <todd.short@me.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 21 14:28:22 2026
(Merged from https://github.com/openssl/openssl/pull/31993)

diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt
index 14658d76341c4e484f91dc87588a9149bb909f9e..8b6c9129776f3176f41ccd17964ca9c2f8b90d79 100644 (file)
--- a/crypto/err/openssl.txt
+++ b/crypto/err/openssl.txt
@@ -1645,25 +1645,24 @@ SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE:1113:\
 SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE:1111:tlsv1 certificate unobtainable
 SSL_R_TLSV1_UNRECOGNIZED_NAME:1112:tlsv1 unrecognized name
 SSL_R_TLSV1_UNSUPPORTED_EXTENSION:1110:tlsv1 unsupported extension
-SSL_R_TLS_ALERT_BAD_CERTIFICATE:1042:ssl/tls alert bad certificate
-SSL_R_TLS_ALERT_BAD_RECORD_MAC:1020:ssl/tls alert bad record mac
-SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED:1045:ssl/tls alert certificate expired
-SSL_R_TLS_ALERT_CERTIFICATE_REVOKED:1044:ssl/tls alert certificate revoked
-SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN:1046:ssl/tls alert certificate unknown
-SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE:1030:ssl/tls alert decompression failure
-SSL_R_TLS_ALERT_HANDSHAKE_FAILURE:1040:ssl/tls alert handshake failure
-SSL_R_TLS_ALERT_ILLEGAL_PARAMETER:1047:ssl/tls alert illegal parameter
-SSL_R_TLS_ALERT_NO_CERTIFICATE:1041:ssl/tls alert no certificate
-SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE:1010:ssl/tls alert unexpected message
-SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE:1043:\
-       ssl/tls alert unsupported certificate
+SSL_R_TLS_ALERT_BAD_CERTIFICATE:1042:tls alert bad certificate
+SSL_R_TLS_ALERT_BAD_RECORD_MAC:1020:tls alert bad record mac
+SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED:1045:tls alert certificate expired
+SSL_R_TLS_ALERT_CERTIFICATE_REVOKED:1044:tls alert certificate revoked
+SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN:1046:tls alert certificate unknown
+SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE:1030:tls alert decompression failure
+SSL_R_TLS_ALERT_HANDSHAKE_FAILURE:1040:tls alert handshake failure
+SSL_R_TLS_ALERT_ILLEGAL_PARAMETER:1047:tls alert illegal parameter
+SSL_R_TLS_ALERT_NO_CERTIFICATE:1041:tls alert no certificate
+SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE:1010:tls alert unexpected message
+SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE:1043:tls alert unsupported certificate
 SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH:232:\
-       ssl3 ext invalid max fragment length
-SSL_R_TLS_EXT_INVALID_SERVERNAME:319:ssl3 ext invalid servername
-SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE:320:ssl3 ext invalid servername type
+       tls ext invalid max fragment length
+SSL_R_TLS_EXT_INVALID_SERVERNAME:319:tls ext invalid servername
+SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE:320:tls ext invalid servername type
 SSL_R_TLS_ILLEGAL_EXPORTER_LABEL:367:tls illegal exporter label
 SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST:157:tls invalid ecpointformat list
-SSL_R_TLS_SESSION_ID_TOO_LONG:300:ssl3 session id too long
+SSL_R_TLS_SESSION_ID_TOO_LONG:300:tls session id too long
 SSL_R_TOO_MANY_KEY_UPDATES:132:too many key updates
 SSL_R_TOO_MANY_WARN_ALERTS:409:too many warn alerts
 SSL_R_TOO_MUCH_EARLY_DATA:164:too much early data

diff --git a/crypto/ssl_err.c b/crypto/ssl_err.c
index 0dca54bb1db63af012255c387aff7dbfdfcd84ad..9766b643146a9114a19be6ef01073b1bbe832f11 100644 (file)
--- a/crypto/ssl_err.c
+++ b/crypto/ssl_err.c
@@ -426,36 +426,6 @@ static const ERR_STRING_DATA SSL_str_reasons[] = {
         "srtp protection profile list too long" },
     { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE),
         "srtp unknown protection profile" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH),
-        "tls ext invalid max fragment length" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_SERVERNAME),
-        "tls ext invalid servername" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE),
-        "tls ext invalid servername type" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_SESSION_ID_TOO_LONG),
-        "tls session id too long" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_BAD_CERTIFICATE),
-        "tls alert bad certificate" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_BAD_RECORD_MAC),
-        "tls alert bad record mac" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED),
-        "tls alert certificate expired" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_REVOKED),
-        "tls alert certificate revoked" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN),
-        "tls alert certificate unknown" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE),
-        "tls alert decompression failure" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_HANDSHAKE_FAILURE),
-        "tls alert handshake failure" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_ILLEGAL_PARAMETER),
-        "tls alert illegal parameter" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_NO_CERTIFICATE),
-        "tls alert no certificate" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE),
-        "tls alert unexpected message" },
-    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE),
-        "tls alert unsupported certificate" },
     { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_SSL_COMMAND_SECTION_EMPTY),
         "ssl command section empty" },
     { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_SSL_COMMAND_SECTION_NOT_FOUND),
@@ -534,10 +504,40 @@ static const ERR_STRING_DATA SSL_str_reasons[] = {
         "tlsv1 unrecognized name" },
     { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLSV1_UNSUPPORTED_EXTENSION),
         "tlsv1 unsupported extension" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_BAD_CERTIFICATE),
+        "tls alert bad certificate" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_BAD_RECORD_MAC),
+        "tls alert bad record mac" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED),
+        "tls alert certificate expired" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_REVOKED),
+        "tls alert certificate revoked" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN),
+        "tls alert certificate unknown" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE),
+        "tls alert decompression failure" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_HANDSHAKE_FAILURE),
+        "tls alert handshake failure" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_ILLEGAL_PARAMETER),
+        "tls alert illegal parameter" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_NO_CERTIFICATE),
+        "tls alert no certificate" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE),
+        "tls alert unexpected message" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE),
+        "tls alert unsupported certificate" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH),
+        "tls ext invalid max fragment length" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_SERVERNAME),
+        "tls ext invalid servername" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE),
+        "tls ext invalid servername type" },
     { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL),
         "tls illegal exporter label" },
     { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST),
         "tls invalid ecpointformat list" },
+    { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_SESSION_ID_TOO_LONG),
+        "tls session id too long" },
     { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TOO_MANY_KEY_UPDATES),
         "too many key updates" },
     { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TOO_MANY_WARN_ALERTS),

diff --git a/crypto/sslerr.h b/crypto/sslerr.h
index 968f27b00a6be5d7233d2328ba30374ab9abfdc6..f2936b7d9999582af7d103b2f5c996cfe250916b 100644 (file)
--- a/crypto/sslerr.h
+++ b/crypto/sslerr.h
@@ -1,6 +1,6 @@
 /*
  * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy

diff --git a/include/openssl/sslerr.h b/include/openssl/sslerr.h
index 28e38861696f3301f86b7ee3411e584dc17a1c64..6ae701dba0696b5823469d818134af3ad98af6c7 100644 (file)
--- a/include/openssl/sslerr.h
+++ b/include/openssl/sslerr.h
@@ -269,21 +269,6 @@
 #define SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES 362
 #define SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG 363
 #define SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE 364
-#define SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH 232
-#define SSL_R_TLS_EXT_INVALID_SERVERNAME 319
-#define SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE 320
-#define SSL_R_TLS_SESSION_ID_TOO_LONG 300
-#define SSL_R_TLS_ALERT_BAD_CERTIFICATE 1042
-#define SSL_R_TLS_ALERT_BAD_RECORD_MAC 1020
-#define SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED 1045
-#define SSL_R_TLS_ALERT_CERTIFICATE_REVOKED 1044
-#define SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN 1046
-#define SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE 1030
-#define SSL_R_TLS_ALERT_HANDSHAKE_FAILURE 1040
-#define SSL_R_TLS_ALERT_ILLEGAL_PARAMETER 1047
-#define SSL_R_TLS_ALERT_NO_CERTIFICATE 1041
-#define SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE 1010
-#define SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE 1043
 #define SSL_R_SSL_COMMAND_SECTION_EMPTY 117
 #define SSL_R_SSL_COMMAND_SECTION_NOT_FOUND 125
 #define SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION 228
@@ -326,8 +311,23 @@
 #define SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE 1111
 #define SSL_R_TLSV1_UNRECOGNIZED_NAME 1112
 #define SSL_R_TLSV1_UNSUPPORTED_EXTENSION 1110
+#define SSL_R_TLS_ALERT_BAD_CERTIFICATE 1042
+#define SSL_R_TLS_ALERT_BAD_RECORD_MAC 1020
+#define SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED 1045
+#define SSL_R_TLS_ALERT_CERTIFICATE_REVOKED 1044
+#define SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN 1046
+#define SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE 1030
+#define SSL_R_TLS_ALERT_HANDSHAKE_FAILURE 1040
+#define SSL_R_TLS_ALERT_ILLEGAL_PARAMETER 1047
+#define SSL_R_TLS_ALERT_NO_CERTIFICATE 1041
+#define SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE 1010
+#define SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE 1043
+#define SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH 232
+#define SSL_R_TLS_EXT_INVALID_SERVERNAME 319
+#define SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE 320
 #define SSL_R_TLS_ILLEGAL_EXPORTER_LABEL 367
 #define SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST 157
+#define SSL_R_TLS_SESSION_ID_TOO_LONG 300
 #define SSL_R_TOO_MANY_KEY_UPDATES 132
 #define SSL_R_TOO_MANY_WARN_ALERTS 409
 #define SSL_R_TOO_MUCH_EARLY_DATA 164