Dear Mbed TLS contributors, We are using mbedtls v4 for X.509 certificate verification on a 32 bit microcontroller. The device has an RTC chip and we use its time for mbedtls by defining MBEDTLS_PLATFORM_TIME_ALT. This is working so far.
The compiler provides <time.h>, with time_t being a signed 32 bit type. I would like to stop mbedtls from using the date and time functions of <time.h> and change mbedtls_time_t to unsigned 32 bit to avoid the year 2038 problem (when signed 32 bit time_t will overflow). To do this, I defined #define MBEDTLS_PLATFORM_TIME_TYPE_MACRO unsigned long
I also changed the custom time function (MBEDTLS_PLATFORM_TIME_ALT) to return unsigned values and I defined MBEDTLS_PLATFORM_GMTIME_R_ALT and provided a custom mbedtls_platform_gmtime_r() that accepts unsigned values.
When I build mbedtls with these settings, I get an error from tf_psa_crypto_check_config.h:
#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) &&\ ( defined(MBEDTLS_PLATFORM_STD_TIME) ||\ defined(MBEDTLS_PLATFORM_TIME_ALT) ) #error "MBEDTLS_PLATFORM_TIME_TYPE_MACRO and MBEDTLS_PLATFORM_STD_TIME/MBEDTLS_PLATFORM_TIME_ALT cannot be defined simultaneously" #endif
I wonder if this check is actually necessary or maybe a mistake? Actually, I expected the opposite, i.e.
#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) &&\ !( defined(MBEDTLS_PLATFORM_STD_TIME) ||\ defined(MBEDTLS_PLATFORM_TIME_ALT) ) #error "Must provide alternate time() function compatible with type defined by MBEDTLS_PLATFORM_TIME_TYPE_MACRO" #endif
Could somebody please explain why MBEDTLS_PLATFORM_TIME_TYPE_MACRO can't be used with MBEDTLS_PLATFORM_TIME_ALT? Can/Should I comment out the #error? I tried that and the library compiles without errors, and the software using the library also compiles without errors, but I have not yet checked, if it actually works.
Best regards, Ralf Huber KION Supply Chain Solutions
Linde Material Handling GmbH, Sitz der Gesellschaft: Aschaffenburg, Registergericht: Aschaffenburg HRB9963, Ust-IdNr. DE814809128, Gesch?ftsf?hrung: Andreas Krinninger (Vorsitzender), Dr. Karoline Jung-Senssfelder, Ulrike Just, Dr. Frank Schepp, Vorsitzende des Aufsichtsrats: Valeria Gargiulo
Hello,
I agree that this looks like a mistake. The various platform interfaces are subtly different, and I suspect that this was inspired by a similar check for a different interface that doesn't apply here. This is not tested (I think we have no tests for custom platform types).
Can you please submit a patch?
Hello Gilles,
Thank you for your reply. I can try submitting a patch, but I have never worked with Github so far, so I first need to figure out how that works 😃
After digging a bit deeper, I have some concerns about the types that can reasonably be used for MBEDTLS_PLATFORM_TIME_TYPE_MACRO. I’m hesitant to submit a patch unless I understand its effects.
From x509.c:
int mbedtls_x509_time_gmtime(mbedtls_time_t tt, mbedtls_x509_time *now) { struct tm tm;
if (mbedtls_platform_gmtime_r(&tt, &tm) == NULL) { return -1; }
now->year = tm.tm_year + 1900; now->mon = tm.tm_mon + 1; now->day = tm.tm_mday; now->hour = tm.tm_hour; now->min = tm.tm_min; now->sec = tm.tm_sec; return 0; }
static int x509_get_current_time(mbedtls_x509_time *now) { return mbedtls_x509_time_gmtime(mbedtls_time(NULL), now); }
x509_get_current_time() passes the output of the custom mbedtls_time() directly to mbedtls_x509_time_gmtime(), where it is immediately passed to mbedtls_platform_gmtime_r().
For this particular piece of code, MBEDTLS_PLATFORM_TIME_TYPE_MACRO could be anything (basic type, structure, function pointer, etc.), as long as the custom mbedtls_platform_gmtime_r() can process the return value from the custom mbedtls_time().
However, if the return value of mbedtls_time() is used somewhere in Mbed TLS without passing it through mbedtls_platform_gmtime_r(), then the caller likely expects that mbedtls_time() behaves like the time() function of <time.h>. MBEDTLS_PLATFORM_TIME_TYPE_MACRO must then have the same properties as time_t (as defined in the C standard), or at least it must have those properties that Mbed TLS relies on.
To add a compile-time check for suitable configurations of MBEDTLS_PLATFORM_TIME_TYPE_MACRO, I would need to know what properties Mbed TLS expects from it, and then somehow check if the custom MBEDTLS_PLATFORM_TIME_TYPE_MACRO type has these properties.
We only use a subset of Mbed TLS in our application. Using uint32_t for MBEDTLS_PLATFORM_TIME_TYPE_MACRO might work for us, but maybe there are other features in Mbed TLS where it would fail. I haven’t searched through the whole Mbed TLS code.
Is it certain that the only thing that is ever done with the return value of mbedtls_time(), is that it is being passed to mbedtls_platform_gmtime_r()? I.e. the only purpose of MBEDTLS_PLATFORM_TIME_TYPE_MACRO is to align the return type of mbedtls_time() with the type of the first parameter of mbedtls_platform_gmtime_r()?
Best regards, Ralf
KION Supply Chain Solutions
Von: Gilles Peskine gilles.peskine@arm.com Gesendet: Montag, 20. Juli 2026 18:51 An: Huber, Ralf ralf.huber@kiongroup.com; mbed-tls@lists.trustedfirmware.org Betreff: Re: [mbed-tls] MBEDTLS_PLATFORM_TIME_TYPE_MACRO for custom mbedtls_time_t
WARNING: This email originated outside of the company. DO NOT CLICK links or attachments or enter any information into forms unless you trust the sender and know the content is safe. Hello,
I agree that this looks like a mistake. The various platform interfaces are subtly different, and I suspect that this was inspired by a similar check for a different interface that doesn't apply here. This is not tested (I think we have no tests for custom platform types).
Can you please submit a patch?
-- Best regards,
Gilles Peskine TF-PSA-Crypto and Mbed TLS developer On 18/07/2026 15:15, Huber, Ralf via mbed-tls wrote: Dear Mbed TLS contributors, We are using mbedtls v4 for X.509 certificate verification on a 32 bit microcontroller. The device has an RTC chip and we use its time for mbedtls by defining MBEDTLS_PLATFORM_TIME_ALT. This is working so far.
The compiler provides <time.h>, with time_t being a signed 32 bit type. I would like to stop mbedtls from using the date and time functions of <time.h> and change mbedtls_time_t to unsigned 32 bit to avoid the year 2038 problem (when signed 32 bit time_t will overflow). To do this, I defined #define MBEDTLS_PLATFORM_TIME_TYPE_MACRO unsigned long
I also changed the custom time function (MBEDTLS_PLATFORM_TIME_ALT) to return unsigned values and I defined MBEDTLS_PLATFORM_GMTIME_R_ALT and provided a custom mbedtls_platform_gmtime_r() that accepts unsigned values.
When I build mbedtls with these settings, I get an error from tf_psa_crypto_check_config.h:
#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) &&\ ( defined(MBEDTLS_PLATFORM_STD_TIME) ||\ defined(MBEDTLS_PLATFORM_TIME_ALT) ) #error "MBEDTLS_PLATFORM_TIME_TYPE_MACRO and MBEDTLS_PLATFORM_STD_TIME/MBEDTLS_PLATFORM_TIME_ALT cannot be defined simultaneously" #endif
I wonder if this check is actually necessary or maybe a mistake? Actually, I expected the opposite, i.e.
#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) &&\ !( defined(MBEDTLS_PLATFORM_STD_TIME) ||\ defined(MBEDTLS_PLATFORM_TIME_ALT) ) #error "Must provide alternate time() function compatible with type defined by MBEDTLS_PLATFORM_TIME_TYPE_MACRO" #endif
Could somebody please explain why MBEDTLS_PLATFORM_TIME_TYPE_MACRO can’t be used with MBEDTLS_PLATFORM_TIME_ALT? Can/Should I comment out the #error? I tried that and the library compiles without errors, and the software using the library also compiles without errors, but I have not yet checked, if it actually works.
Best regards, Ralf Huber KION Supply Chain Solutions
Linde Material Handling GmbH, Sitz der Gesellschaft: Aschaffenburg, Registergericht: Aschaffenburg HRB9963, Ust-IdNr. DE814809128, Geschäftsführung: Andreas Krinninger (Vorsitzender), Dr. Karoline Jung-Senssfelder, Ulrike Just, Dr. Frank Schepp, Vorsitzende des Aufsichtsrats: Valeria Gargiulo
Linde Material Handling GmbH, Sitz der Gesellschaft: Aschaffenburg, Registergericht: Aschaffenburg HRB9963, Ust-IdNr. DE814809128, Geschäftsführung: Andreas Krinninger (Vorsitzender), Dr. Karoline Jung-Senssfelder, Ulrike Just, Dr. Frank Schepp, Vorsitzende des Aufsichtsrats: Valeria Gargiulo
That's a good question. I don't know the answer offhand. I've filed an issue to clarify that: https://github.com/Mbed-TLS/mbedtls/issues/10846
mbed-tls@lists.trustedfirmware.org
-
Gilles Peskine -
Huber, Ralf