I have an application where I create a partial x509 certificate. It gets sent to an HSM, which adds the public key and signs it.

I do essentially this to build the X509 structure::

X509_new
X509_set_version
X509_set_issuer_name
X509_get_notBefore
X509_get_notAfter
X509_set_subject_name
X509_EXTENSION_create_by_OBJ
i2d_x509 

This worked in 1.0.1, 1.0.2, 1.1.1, but fails in 3.0.0.

In debugging, even this simple test case now fails.

X509_new
i2d_x509 

I tried including everything except the signature, omitting just

X509_sign

and it also failed.

I also tried replacing i2d_x509 with i2d_re_X509_tbs and it also failed.

It could be user error, but this has been working for many years.