Commit 98a76faf67 for openssl.org

commit 98a76faf6725d4e3f76eac72858f149ef19e4808
Author: Bob Beck <beck@openssl.org>
Date:   Sat Sep 5 11:47:33 2026 -0600

    Document when X509_cmp() and X509_CRL_match() order objects

    Their result orders objects consistently only while none has been
    modified since it was signed or decoded and each has its internal hash;
    a modified object is unequal to everything but two modified objects are
    not ordered with respect to each other. Say so instead of claiming the
    sign always orders the objects.

    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Thu Sep 17 16:44:36 2026
    Merged-from: https://github.com/openssl/openssl/pull/32686

diff --git a/doc/man3/X509_cmp.pod b/doc/man3/X509_cmp.pod
index c5e95394a5..b4a8872fce 100644
--- a/doc/man3/X509_cmp.pod
+++ b/doc/man3/X509_cmp.pod
@@ -28,8 +28,7 @@ The X509_cmp() function compares two B<X509> objects indicated by parameters
 I<a> and I<b>. The comparison is based on the B<memcmp> result of the hash
 values of two B<X509> objects and the canonical (DER) encoding values.
 A certificate that has been modified since it was signed or decoded, and
-not signed again, compares equal only to itself, and sorts after any
-certificate that has not been modified.
+not signed again, compares equal only to itself.

 The X509_NAME_cmp() function compares two B<X509_NAME> objects indicated by
 parameters I<a> and I<b>, any of which may be NULL.
@@ -52,8 +51,7 @@ objects, respectively.
 The X509_CRL_match() function compares two B<X509_CRL> objects. Unlike the
 X509_CRL_cmp() function, this function compares the whole CRL content instead
 of just the issuer name. A CRL that has been modified since it was signed or
-decoded, and not signed again, compares equal only to itself, and sorts after
-any CRL that has not been modified.
+decoded, and not signed again, compares equal only to itself.

 =head1 RETURN VALUES

@@ -70,8 +68,11 @@ to indicate an error, and callers should still be prepared to receive it.

 These functions in fact utilize the underlying B<memcmp> of the C library to do
 the comparison job. Data to be compared varies from DER encoding data, hash
-value or B<ASN1_STRING>. The sign of the comparison can be used to order the
-objects but it does not have a special meaning in some cases.
+value or B<ASN1_STRING>. The sign of the result of X509_cmp() and
+X509_CRL_match() orders objects consistently only while none of them has been
+modified since it was signed or decoded, and the internal hash of each could
+be computed. A modified object compares unequal to every other object, but
+two modified objects are not ordered with respect to each other.

 X509_NAME_cmp() and wrappers utilize the value B<-2> to indicate errors in some
 circumstances, which could cause confusion for the applications.