new file mode 100644
@@ -0,0 +1,49 @@
+From 82d28b1be73bbc00e73e59d0c59c51a1e76519a5 Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo@redhat.com>
+Date: Mon, 27 Apr 2026 17:49:56 -0400
+Subject: [PATCH] Add const qualifiers to OpenSSL X509 pointers
+
+Added const qualifiers to the X509_NAME and X509_NAME_ENTRY pointers when
+retrieving subject and issuer names from TLS certificates. This ensures const-
+correctness and maintains compatibility with newer OpenSSL versions, which
+return const pointers from these getter functions.
+
+Signed-off-by: Simo Sorce <simo@redhat.com>
+
+Upstream-Status: Backport [https://gitlab.isc.org/isc-projects/kea/-/issues/4673]
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ src/lib/asiolink/openssl_tls.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/lib/asiolink/openssl_tls.h b/src/lib/asiolink/openssl_tls.h
+index 57c3323..52a969b 100644
+--- a/src/lib/asiolink/openssl_tls.h
++++ b/src/lib/asiolink/openssl_tls.h
+@@ -175,9 +175,9 @@ public:
+ if (!cert) {
+ return ("");
+ }
+- ::X509_NAME *name = ::X509_get_subject_name(cert);
++ const ::X509_NAME *name = ::X509_get_subject_name(cert);
+ int loc = ::X509_NAME_get_index_by_NID(name, NID_commonName, -1);
+- ::X509_NAME_ENTRY* ne = ::X509_NAME_get_entry(name, loc);
++ const ::X509_NAME_ENTRY* ne = ::X509_NAME_get_entry(name, loc);
+ if (!ne) {
+ ::X509_free(cert);
+ return ("");
+@@ -209,9 +209,9 @@ public:
+ if (!cert) {
+ return ("");
+ }
+- ::X509_NAME *name = ::X509_get_issuer_name(cert);
++ const ::X509_NAME *name = ::X509_get_issuer_name(cert);
+ int loc = ::X509_NAME_get_index_by_NID(name, NID_commonName, -1);
+- ::X509_NAME_ENTRY* ne = ::X509_NAME_get_entry(name, loc);
++ const ::X509_NAME_ENTRY* ne = ::X509_NAME_get_entry(name, loc);
+ if (!ne) {
+ ::X509_free(cert);
+ return ("");
+--
+2.53.0
+
@@ -19,6 +19,7 @@ SRC_URI = "http://ftp.isc.org/isc/kea/${PV}/${BP}.tar.xz \
file://0001-src-lib-log-logger_unittest_support.cc-do-not-write-.patch \
file://0001-meson-use-a-runtime-safe-interpreter-string.patch \
file://0001-mk_cfgrpt.sh-strip-prefixes.patch \
+ file://0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch \
"
SRC_URI[sha256sum] = "14bf695d37b65b9b1bf550fea5d0adaf9806c50e5419ef2a176a4b8e9aade3df"
OpenSSL 4.0 added const qualifiers to X509_get_subject_name() and X509_get_issuer_name() return types. kea assigns these to non-const pointers causing compilation errors with -fpermissive. Add const qualifiers to X509_NAME and X509_NAME_ENTRY pointer declarations in openssl_tls.h. Tracked upstream: https://gitlab.isc.org/isc-projects/kea/-/issues/4673 (milestone: kea3.3.2, labeled: backport-candidate) Upstream-Status: Backport [https://gitlab.isc.org/isc-projects/kea/-/issues/4673] Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> --- ...-qualifiers-to-OpenSSL-X509-pointers.patch | 49 +++++++++++++++++++ meta/recipes-connectivity/kea/kea_3.2.0.bb | 1 + 2 files changed, 50 insertions(+) create mode 100644 meta/recipes-connectivity/kea/files/0001-Add-const-qualifiers-to-OpenSSL-X509-pointers.patch