Fix invalid cast from ASN1_TIME to ASN1_GENERALIZEDTIME

[moriyoshi]

X509_get_notBefore() and X509_get_notAfter() return a ASN1_TIME structure which is not compatible with ASN1_GENERALIZEDTIME, but the original code recklessly casts it to ASN1_GENERALIZEDTIME and pass it to ASN1_GENERALIZEDTIME_set_string().

LibreSSL is rigorous enough to reject such.

pyca/cryptography#3491 needs to be applied to cryptography before the application of this patch.

[codecov]

Codecov Report

Merging #612 into master will increase coverage by 0.03%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master     #612      +/-   ##
==========================================
+ Coverage   96.78%   96.81%   +0.03%     
==========================================
  Files          18       18              
  Lines        5626     5621       -5     
  Branches      390      389       -1     
==========================================
- Hits         5445     5442       -3     
+ Misses        121      120       -1     
+ Partials       60       59       -1

Impacted Files	Coverage Δ
src/OpenSSL/crypto.py	96.55% <100%> (+0.16%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a40898b...b93f1c3. Read the comment docs.

[moriyoshi]

UPDATE: pyca/cryptography#3491 was merged.

[moriyoshi]

Bumped up cryptography version requirement. Ready to merge.

[reaperhulk]

Those two functions do return an ASN1_TIME, but unfortunately the pyOpenSSL API here for set_notAfter and set_notBefore is documented as taking the form of a byte string generalized time. (e.g. not just YYYYMMDDHHMMSSZ but also YYYYMMDDhhmmss+hhmm or YYYYMMDDhhmmss-hhmm). No one should ever have been passing any form other than the first though, and after checking our primary downstreams it looks like that's not a thing anyone is doing, so let's go ahead and make the change.

[moriyoshi]

the pyOpenSSL API here for set_notAfter and set_notBefore is documented as taking the form of a byte string generalized time. (e.g. not just YYYYMMDDHHMMSSZ but also YYYYMMDDhhmmss+hhmm or YYYYMMDDhhmmss-hhmm).

It appears ASN1_TIME_set_string() can handle the generalized time in addition to the UTC time. (ASN1_TIME is a neutral data structure that can represent either ASN1_UTCTIME or ASN1_GENERALIZEDTIME )

/~https://github.com/openssl/openssl/blob/master/crypto/asn1/a_time.c#L120-L124

BTW, ASN1_TIME_set_string_X509() is supposed to be better here rather than ASN1_TIME_set_string(), which is a newly introduced, more strict variant of the latter:

openssl/openssl@04e6271

[reaperhulk]

Interesting. Thanks for investigating that. We should revert that backwards incompatibility warning then.