Commit 104ec0dae0 for openssl.org

commit 104ec0dae0fffdcf6599c6372cfcd50d7533310d
Author: Neil Horman <nhorman@openssl.org>
Date:   Thu Feb 19 10:52:31 2026 -0500

    Constify X509_CRL_get0_by_cert

    Update the X509 parameter to be const

    Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
    Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
    MergeDate: Sun Feb 22 17:55:12 2026
    (Merged from https://github.com/openssl/openssl/pull/30090)

diff --git a/crypto/x509/x_crl.c b/crypto/x509/x_crl.c
index 13d8d40ad1..89a64fec03 100644
--- a/crypto/x509/x_crl.c
+++ b/crypto/x509/x_crl.c
@@ -452,7 +452,7 @@ int X509_CRL_get0_by_serial(X509_CRL *crl,
     return 0;
 }

-int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x)
+int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, const X509 *x)
 {
     if (crl->meth->crl_lookup)
         return crl->meth->crl_lookup(crl, ret,
diff --git a/doc/man3/X509_CRL_get0_by_serial.pod b/doc/man3/X509_CRL_get0_by_serial.pod
index 8ec5bfc0da..1db7c174f1 100644
--- a/doc/man3/X509_CRL_get0_by_serial.pod
+++ b/doc/man3/X509_CRL_get0_by_serial.pod
@@ -14,7 +14,7 @@ functions

  int X509_CRL_get0_by_serial(X509_CRL *crl,
                              X509_REVOKED **ret, const ASN1_INTEGER *serial);
- int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x);
+ int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, const X509 *x);

  STACK_OF(X509_REVOKED) *X509_CRL_get_REVOKED(const X509_CRL *crl);

@@ -107,6 +107,8 @@ L<X509_verify_cert(3)>

 X509_CRL_get_REVOKED() was constified in OpenSSL 4.0.

+X509_CRL_get0_by_cert was constified in OpenSSL 4.0.
+
 =head1 COPYRIGHT

 Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
diff --git a/include/openssl/x509.h.in b/include/openssl/x509.h.in
index ccbb538ce1..b0d3494d9c 100644
--- a/include/openssl/x509.h.in
+++ b/include/openssl/x509.h.in
@@ -613,7 +613,7 @@ X509_CRL *X509_CRL_new_ex(OSSL_LIB_CTX *libctx, const char *propq);
 int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev);
 int X509_CRL_get0_by_serial(X509_CRL *crl,
     X509_REVOKED **ret, const ASN1_INTEGER *serial);
-int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x);
+int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, const X509 *x);

 X509_PKEY *X509_PKEY_new(void);
 void X509_PKEY_free(X509_PKEY *a);