Commit 13e3ecbcb9 for openssl.org

commit 13e3ecbcb94b39d05815e301845e4490278f842a
Author: Mounir IDRASSI <mounir.idrassi@idrix.fr>
Date:   Sun Aug 16 14:24:03 2026 +0900

    ocsp: Report expired nextUpdate with the correct reason

    OCSP_check_validity() already rejects an expired nextUpdate, but it
    reports the not yet valid reason. Raise OCSP_R_STATUS_EXPIRED instead.

    Fixes #32399

    CLA: trivial
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Richard Levitte <levitte@openssl.org>
    Reviewed-by: Bob Beck <beck@openssl.org>
    Merge-date: Wed Aug 19 10:50:46 2026
    Merged-from: https://github.com/openssl/openssl/pull/32400

diff --git a/crypto/ocsp/ocsp_cl.c b/crypto/ocsp/ocsp_cl.c
index 432edba314..3e057caa61 100644
--- a/crypto/ocsp/ocsp_cl.c
+++ b/crypto/ocsp/ocsp_cl.c
@@ -347,7 +347,7 @@ int OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd,
         }
         /* Check nextUpdate is not more than nsec in the past */
         if (next_time < t_now - nsec) {
-            ERR_raise(ERR_LIB_OCSP, OCSP_R_STATUS_NOT_YET_VALID);
+            ERR_raise(ERR_LIB_OCSP, OCSP_R_STATUS_EXPIRED);
             goto err;
         }
         /* Also don't allow nextUpdate to precede thisUpdate */