Commit ba2f3b557a for openssl.org
commit ba2f3b557a660cbe2a0fc0e99b1830cb930a090f
Author: Todd Short <todd.short@me.com>
Date: Fri Jul 17 17:34:11 2026 -0400
errors: fix stale string overrides in openssl.txt for renamed SSL error codes
Commit b3d26e438a ("merge feature/removesslv3", PR #29338) renamed SSL3
error codes to TLS equivalents and updated the string descriptions in
crypto/ssl_err.c (e.g. from "ssl/tls alert bad certificate" to
"tls alert bad certificate"), but did not update the corresponding
strings in crypto/err/openssl.txt.
This caused a latent divergence: running mkerr.pl -rebuild would
regenerate ssl_err.c with the old openssl.txt strings, undoing the
intentional name cleanup. Similarly, adding any new SSL error code
triggers a full SSL regeneration that would revert the strings and
reorder entries to their correct alphabetical positions, producing
spurious changes unrelated to the new code.
Update openssl.txt to match the strings already in ssl_err.c, which
also happen to be the auto-generated strings derived from the reason
code names. Regenerate ssl_err.c and sslerr.h with the correct
alphabetical ordering so that future make update runs are idempotent:
adding and removing a new SSL error code now produces only the expected
changes to the generated files, with no side-effect reordering or
string reversions.
Fixes: b3d26e438a ("Rename SSL3 error codes to TLS equivalents")
Signed-off-by: Todd Short <todd.short@me.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jul 21 14:28:22 2026
(Merged from https://github.com/openssl/openssl/pull/31993)
diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt
index 14658d7634..8b6c912977 100644
--- a/crypto/err/openssl.txt
+++ b/crypto/err/openssl.txt
@@ -1645,25 +1645,24 @@ SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE:1113:\
SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE:1111:tlsv1 certificate unobtainable
SSL_R_TLSV1_UNRECOGNIZED_NAME:1112:tlsv1 unrecognized name
SSL_R_TLSV1_UNSUPPORTED_EXTENSION:1110:tlsv1 unsupported extension
-SSL_R_TLS_ALERT_BAD_CERTIFICATE:1042:ssl/tls alert bad certificate
-SSL_R_TLS_ALERT_BAD_RECORD_MAC:1020:ssl/tls alert bad record mac
-SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED:1045:ssl/tls alert certificate expired
-SSL_R_TLS_ALERT_CERTIFICATE_REVOKED:1044:ssl/tls alert certificate revoked
-SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN:1046:ssl/tls alert certificate unknown
-SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE:1030:ssl/tls alert decompression failure
-SSL_R_TLS_ALERT_HANDSHAKE_FAILURE:1040:ssl/tls alert handshake failure
-SSL_R_TLS_ALERT_ILLEGAL_PARAMETER:1047:ssl/tls alert illegal parameter
-SSL_R_TLS_ALERT_NO_CERTIFICATE:1041:ssl/tls alert no certificate
-SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE:1010:ssl/tls alert unexpected message
-SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE:1043:\
- ssl/tls alert unsupported certificate
+SSL_R_TLS_ALERT_BAD_CERTIFICATE:1042:tls alert bad certificate
+SSL_R_TLS_ALERT_BAD_RECORD_MAC:1020:tls alert bad record mac
+SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED:1045:tls alert certificate expired
+SSL_R_TLS_ALERT_CERTIFICATE_REVOKED:1044:tls alert certificate revoked
+SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN:1046:tls alert certificate unknown
+SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE:1030:tls alert decompression failure
+SSL_R_TLS_ALERT_HANDSHAKE_FAILURE:1040:tls alert handshake failure
+SSL_R_TLS_ALERT_ILLEGAL_PARAMETER:1047:tls alert illegal parameter
+SSL_R_TLS_ALERT_NO_CERTIFICATE:1041:tls alert no certificate
+SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE:1010:tls alert unexpected message
+SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE:1043:tls alert unsupported certificate
SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH:232:\
- ssl3 ext invalid max fragment length
-SSL_R_TLS_EXT_INVALID_SERVERNAME:319:ssl3 ext invalid servername
-SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE:320:ssl3 ext invalid servername type
+ tls ext invalid max fragment length
+SSL_R_TLS_EXT_INVALID_SERVERNAME:319:tls ext invalid servername
+SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE:320:tls ext invalid servername type
SSL_R_TLS_ILLEGAL_EXPORTER_LABEL:367:tls illegal exporter label
SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST:157:tls invalid ecpointformat list
-SSL_R_TLS_SESSION_ID_TOO_LONG:300:ssl3 session id too long
+SSL_R_TLS_SESSION_ID_TOO_LONG:300:tls session id too long
SSL_R_TOO_MANY_KEY_UPDATES:132:too many key updates
SSL_R_TOO_MANY_WARN_ALERTS:409:too many warn alerts
SSL_R_TOO_MUCH_EARLY_DATA:164:too much early data
diff --git a/crypto/ssl_err.c b/crypto/ssl_err.c
index 0dca54bb1d..9766b64314 100644
--- a/crypto/ssl_err.c
+++ b/crypto/ssl_err.c
@@ -426,36 +426,6 @@ static const ERR_STRING_DATA SSL_str_reasons[] = {
"srtp protection profile list too long" },
{ ERR_PACK(ERR_LIB_SSL, 0, SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE),
"srtp unknown protection profile" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH),
- "tls ext invalid max fragment length" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_SERVERNAME),
- "tls ext invalid servername" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE),
- "tls ext invalid servername type" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_SESSION_ID_TOO_LONG),
- "tls session id too long" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_BAD_CERTIFICATE),
- "tls alert bad certificate" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_BAD_RECORD_MAC),
- "tls alert bad record mac" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED),
- "tls alert certificate expired" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_REVOKED),
- "tls alert certificate revoked" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN),
- "tls alert certificate unknown" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE),
- "tls alert decompression failure" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_HANDSHAKE_FAILURE),
- "tls alert handshake failure" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_ILLEGAL_PARAMETER),
- "tls alert illegal parameter" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_NO_CERTIFICATE),
- "tls alert no certificate" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE),
- "tls alert unexpected message" },
- { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE),
- "tls alert unsupported certificate" },
{ ERR_PACK(ERR_LIB_SSL, 0, SSL_R_SSL_COMMAND_SECTION_EMPTY),
"ssl command section empty" },
{ ERR_PACK(ERR_LIB_SSL, 0, SSL_R_SSL_COMMAND_SECTION_NOT_FOUND),
@@ -534,10 +504,40 @@ static const ERR_STRING_DATA SSL_str_reasons[] = {
"tlsv1 unrecognized name" },
{ ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLSV1_UNSUPPORTED_EXTENSION),
"tlsv1 unsupported extension" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_BAD_CERTIFICATE),
+ "tls alert bad certificate" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_BAD_RECORD_MAC),
+ "tls alert bad record mac" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED),
+ "tls alert certificate expired" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_REVOKED),
+ "tls alert certificate revoked" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN),
+ "tls alert certificate unknown" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE),
+ "tls alert decompression failure" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_HANDSHAKE_FAILURE),
+ "tls alert handshake failure" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_ILLEGAL_PARAMETER),
+ "tls alert illegal parameter" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_NO_CERTIFICATE),
+ "tls alert no certificate" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE),
+ "tls alert unexpected message" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE),
+ "tls alert unsupported certificate" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH),
+ "tls ext invalid max fragment length" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_SERVERNAME),
+ "tls ext invalid servername" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE),
+ "tls ext invalid servername type" },
{ ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL),
"tls illegal exporter label" },
{ ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST),
"tls invalid ecpointformat list" },
+ { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_SESSION_ID_TOO_LONG),
+ "tls session id too long" },
{ ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TOO_MANY_KEY_UPDATES),
"too many key updates" },
{ ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TOO_MANY_WARN_ALERTS),
diff --git a/crypto/sslerr.h b/crypto/sslerr.h
index 968f27b00a..f2936b7d99 100644
--- a/crypto/sslerr.h
+++ b/crypto/sslerr.h
@@ -1,6 +1,6 @@
/*
* Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
diff --git a/include/openssl/sslerr.h b/include/openssl/sslerr.h
index 28e3886169..6ae701dba0 100644
--- a/include/openssl/sslerr.h
+++ b/include/openssl/sslerr.h
@@ -269,21 +269,6 @@
#define SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES 362
#define SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG 363
#define SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE 364
-#define SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH 232
-#define SSL_R_TLS_EXT_INVALID_SERVERNAME 319
-#define SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE 320
-#define SSL_R_TLS_SESSION_ID_TOO_LONG 300
-#define SSL_R_TLS_ALERT_BAD_CERTIFICATE 1042
-#define SSL_R_TLS_ALERT_BAD_RECORD_MAC 1020
-#define SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED 1045
-#define SSL_R_TLS_ALERT_CERTIFICATE_REVOKED 1044
-#define SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN 1046
-#define SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE 1030
-#define SSL_R_TLS_ALERT_HANDSHAKE_FAILURE 1040
-#define SSL_R_TLS_ALERT_ILLEGAL_PARAMETER 1047
-#define SSL_R_TLS_ALERT_NO_CERTIFICATE 1041
-#define SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE 1010
-#define SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE 1043
#define SSL_R_SSL_COMMAND_SECTION_EMPTY 117
#define SSL_R_SSL_COMMAND_SECTION_NOT_FOUND 125
#define SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION 228
@@ -326,8 +311,23 @@
#define SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE 1111
#define SSL_R_TLSV1_UNRECOGNIZED_NAME 1112
#define SSL_R_TLSV1_UNSUPPORTED_EXTENSION 1110
+#define SSL_R_TLS_ALERT_BAD_CERTIFICATE 1042
+#define SSL_R_TLS_ALERT_BAD_RECORD_MAC 1020
+#define SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED 1045
+#define SSL_R_TLS_ALERT_CERTIFICATE_REVOKED 1044
+#define SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN 1046
+#define SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE 1030
+#define SSL_R_TLS_ALERT_HANDSHAKE_FAILURE 1040
+#define SSL_R_TLS_ALERT_ILLEGAL_PARAMETER 1047
+#define SSL_R_TLS_ALERT_NO_CERTIFICATE 1041
+#define SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE 1010
+#define SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE 1043
+#define SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH 232
+#define SSL_R_TLS_EXT_INVALID_SERVERNAME 319
+#define SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE 320
#define SSL_R_TLS_ILLEGAL_EXPORTER_LABEL 367
#define SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST 157
+#define SSL_R_TLS_SESSION_ID_TOO_LONG 300
#define SSL_R_TOO_MANY_KEY_UPDATES 132
#define SSL_R_TOO_MANY_WARN_ALERTS 409
#define SSL_R_TOO_MUCH_EARLY_DATA 164