From: Michael R Sweet <msweet@msweet.org>
Date: Tue, 28 Jul 2026 17:21:45 +0000 (-0400)
Subject: Do some cleanup of TLS cert expiration changes (Issue #1590)
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;ds=sidebyside;p=thirdparty%2Fcups.git

Do some cleanup of TLS cert expiration changes (Issue #1590)
---

diff --git a/CHANGES.md b/CHANGES.md
index 8436359a9b..c71cb2d086 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -181,6 +181,7 @@ v2.5b1 - YYYY-MM-DD
 - Fixed A4 support in the `ippevepcl` program (Issue #1544)
 - Fixed issues with the environment variable support of CGI programs
   (Issue #1547)
+- Fixed renewal of expired self-signed certificates (Issue #1590)
 - Fixed potential crash bug in `cupsCheckDestSupported` function.
 - Removed hash support for SHA2-512-224 and SHA2-512-256.
 - Removed `mantohtml` script for generating html pages (use
diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index ed8fb1fb40..ceb46ddfce 100644
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -1847,7 +1847,7 @@ _httpTLSStart(http_t *http)		// I - Connection to server
         char	*creds = cupsCopyCredentials(tls_keypath, cn);
 					// PEM-encoded certificate
 
-        have_creds = creds && cupsGetCredentialsExpiration(creds) > time(NULL);
+        have_creds = cupsGetCredentialsExpiration(creds) > time(NULL);
         free(creds);
       }
     }
@@ -2226,6 +2226,12 @@ gnutls_import_certs(
 
   DEBUG_printf("3gnutls_import_certs(credentials=\"%s\", num_certs=%p, certs=%p)", credentials, (void *)num_certs, (void *)certs);
 
+  if (!credentials)
+  {
+    *num_certs = 0;
+    return (NULL);
+  }
+
   // Import all certificates from the string...
   datum.data = (void *)credentials;
   datum.size = strlen(credentials);
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index 1dd92028de..c8fe57cf15 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -1929,7 +1929,7 @@ _httpTLSStart(http_t *http)		// I - Connection to server
         char	*creds = cupsCopyCredentials(tls_keypath, cn);
 					// PEM-encoded certificate
 
-        have_creds = creds && cupsGetCredentialsExpiration(creds) > time(NULL);
+        have_creds = cupsGetCredentialsExpiration(creds) > time(NULL);
         free(creds);
       }
     }