feat(libSceSsl): implement certificate validity period and fingerprint queries

[jagrat04]

What

Implements sceSslGetNotBefore, sceSslGetNotAfter, sceSslGetFingerprint, and updates sceSslClose signature.

• Signatures follow VitaSDK and SharpProspero.
• sceSslGetNotBefore and sceSslGetNotAfter convert Mbed TLS certificate validity times (valid_from and valid_to) into microsecond RtcTick values (microseconds since civil year 0001 epoch) matching libSceRtc.
• sceSslGetFingerprint computes certificate digests (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512) over the raw DER certificate payload using Mbed TLS message digest API.
• sceSslClose signature is updated to take int sslConnectionId in line with SharpProspero, resolving its unknown signature technical debt entry.

Tested

• Windows 10 x64
• Unit tests in guest_ssl_load_tests verifying:
  • sceSslGetNotBefore and sceSslGetNotAfter tick calculations against known fixture timestamps
  • sceSslGetFingerprint MD5, SHA-1, and SHA-256 digests against known hashes
  • Boundary and error conditions (null pointers, small buffer error handling, invalid/negative hash types, invalid certificate handles)
  • sceSslClose throws until transport is implemented
  • Handle invalidation after certificate unload / context termination
• Ran ctest -R guest_ssl (100% passed)
• Checked conventions with python tools/check_conventions.py --base origin/main

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes

[github-actions]

Progress report (f8b22ed → fd5eb84)

📈 System libraries: 89.45% (+0.01%, +3 implemented functions)

✅ 3 implemented

Library	Name
libSceSsl	sceSslGetFingerprint
libSceSsl	sceSslGetNotAfter
libSceSsl	sceSslGetNotBefore

[github-actions]

Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.

Pull request	Conflicting files (lines on main)	Same exports	Same new files
PR 6828	core/libs/prx/libSceSsl/Export.cpp L6, L29-30 docs/dev/debt/libSceSsl.md L5-9
PR 7319	core/libs/prx/libSceSsl/Export.cpp L6, L29-30, L521-525 docs/dev/debt/libSceSsl.md L5-7	sceSslClose

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request	Shared files not compared
PR 6039	docs/dev/debt/libSceSsl.md
PR 6044	core/libs/tests/GuestSslLoad.cpp

[jotitadev]

Linux run, full build. The description covers only Windows 10.

Machine: Ubuntu 26.04, Intel i7-8700, GCC 15.2, Release, full build (-DBUILD_TESTING=ON), non-GPU tests. Head 490ced064 merged onto main 03c4cb5e7 (clean merge).

• guest_ssl and guest_ssl_load pass, including the new PEM, validity-period and fingerprint cases.
• Test only (Export.cpp and SslTypes.hpp from main): GuestSslLoad.cpp does not compile (SceSsl::RtcTick is undeclared), so the test cannot run against main. It only covers the change together with the new types.
• Full non-GPU suite: 668/670. The two failures, file_writer_binary and file_writer_text, also fail on plain main on this machine.

Written with AI assistance (Claude Code). I ran the builds and tests above on my machine.

[screamm]

Cross-validation on Windows 11 Pro 26220, NVIDIA RTX 4070 (596.21), MinGW GCC 15.2. This PR contains #5953's commit, so I built the stack main 332b0b1b7 + #5953 (80d257396) + this PR (490ced064); both merges are clean and the tree equals main + this PR. (332b0b1b7 is 5d9dcc42d plus #6371, logging only; main moved during the session.)

• Full build and libs: pass, apart from the known MinGW 64 KiB alignas AGC test object that fails on main too.
• guest_ssl and guest_ssl_load, --repeat until-fail:3: 3 of 3 each.
• Negative control: with Export.cpp reverted to feat(libSceSsl): implement certificate serial and name entry readers #5953's head, guest_ssl_load_tests no longer links (undefined sceSslGetFingerprint, sceSslGetNotAfter, sceSslGetNotBefore); restored, both tests pass. I did not run a separate run-time check of sceSslGetPem.
• ctest -j8 --timeout 120 -E '^agc_driver_|^video_out_flip' on the stack: 833 of 839 pass, 2 skipped, 4 timeouts on a heavily loaded host (conventions_function_bodies, two of its shards, hardware_oracle_compare); one shard passes serially, the shard scripts take about as long on main when timed directly, and hardware_oracle_compare times out on main too. Nothing SSL-related.
• tools/check_conventions.py --base origin/main (on 5d9dcc42d) and git diff --check: pass.
• Exports: libSceSsl.prx gains sceSslGetNotBefore (Eo0S65Jy28Q), sceSslGetNotAfter (xHpt6+2pGYk) and sceSslGetFingerprint (brRtwGBu4A8); NIDs match aerolib.
• Import audit of every relinked registry here (1127 registry files, 51 title folders): only PPSA28319 (Middle Ages Ping Pong) imports any of these functions: sceSslGetPem here and the six from feat(libSceSsl): implement certificate serial and name entry readers #5953. No title imports sceSslGetNotBefore, sceSslGetNotAfter, sceSslGetFingerprint or sceSslClose. With both PRs PPSA28319 has no libSceSsl stub import left (17 -> 10 stub imports overall, 881 -> 888 implemented, 4 absent unchanged).
• PPSA28319, relinked with --trace-imports, APS5_TRACE_CALLS=libSceSsl, 120 s per run, call report read with APS5_HANG_DUMP_SECS=120 (so the only stop line, FATAL: timed dump after 120 s (APS5_HANG_DUMP_SECS); aborting, is self-inflicted): no libSceSsl call in 2 runs on main (3834 and 5536 frames) or 2 runs on the stack (6860 and 6847 frames). A positive control on the stack build with libSceSsl,libScePad traced recorded 3233 calls, all libScePad. The title does not exercise these functions in its first two minutes.
• Conflicts: none with feat(libSceSsl): implement certificate serial and name entry readers #5953 (contained). feat(libSceSsl): record connection verify options, minimum version and ALPN #5911 conflicts in Export.cpp (two hunks around sceSslEnableVerifyOption/sceSslDisableVerifyOption, next to sceSslGetSerialNumber and sceSslGetSubjectName) and in docs/dev/debt/libSceSsl.md; I did not resolve them.

The ABI question raised on #5953 applies here as well: the SharpProspero lines this PR cites (60977b29, Http.cs L306-347) declare sceSslGetNotAfter(int sslCtxId, void* sslCert, ulong*), sceSslGetNotBefore(int sslCtxId, void* sslCert, ulong*) and sceSslGetFingerprint(int sslCtxId, void* sslCert, int hashType, byte*), while the PR drops the context id. The hash-type numbering (0 = MD5 ... 5 = SHA-512) has no cited source either. I would hold this until the signatures are reconciled together with #5953.

Not checked: any TLS connection, Linux/macOS, a title that actually calls these functions.

Written with Claude Code assistance (validation by a subagent, reviewed in this session).

[jagrat04]

Rebased onto PR #5953's updated head (9c72c453d) and reconciled all certificate query signatures with the PS5 context ABI:

1. sceSslGetNotBefore, sceSslGetNotAfter, sceSslGetFingerprint, and sceSslGetPem now take int sslCtxId as their first parameter.
2. Hash algorithm constants (0 = MD5 through 5 = SHA-512) cite SharpProspero's SceSslFingerprintHashAlgorithm enum in docs/dev/debt/libSceSsl.md.
3. Updated unit tests in GuestSslLoad.cpp to verify context-scoped querying, invalid argument handling, and lifecycle cleanup.
4. Verified 100% test pass on Windows and Linux (Ubuntu 26.04 / GCC 15.2 via WSL), with convention checks passing.

[adriadam10]

Checked on the PR merged onto current main: build + ctest in scope pass (guest_ssl_load included), and the new test no longer compiles without the Export.cpp/SslTypes.hpp change. sceSslGetNotBefore/sceSslGetNotAfter/sceSslGetFingerprint match SharpProspero's Http.cs (context id first, ulong* ticks, hash types 0..5 as in SceSslFingerprintHashAlgorithm), and the 0001-01-01 epoch arithmetic is right. One thing to fix:

• core/libs/prx/libSceSsl/Export.cpp:687 sceSslGetPem(int, void*, char*, size_t, size_t*) has no source. SharpProspero's Http.cs has no sceSslGetPem, shadPS4's is an empty stub, and no reference gives the parameter order, the length semantics or the error for a too-small buffer (ErrorInvalidArg at line 699 is a guess). docs/dev/debt/libSceSsl.md says the signatures "follow SharpProspero", which is false for this one. Either keep sceSslGetPem throwing NotImplemented_nid_no_patch and drop it (and its tests) from this PR, or cite a source for the signature and behaviour and list the unmeasured parts under "Unknown function info" in the debt line.

Everything else can stay as is.

[oneandonlydean]

Picking this up while @adriadam10 is away. The code now leaves sceSslGetPem throwing, which answers his review, thanks. Please update the PR title and body to match (validity period and fingerprint only).

[jagrat04]

Updated the PR title and body to match (validity period and fingerprint queries only). Thanks!

Stale: sceSslGetPem now stays a throwing stub and the title/body match (checked while @adriadam10 is away).