utctime and gentime: inline formats, constrain input data

* utctime should not take dates into account with a year below 1950 and above 2049
* gentime year must be 4 digits

Author: HoneyryderChuck

lib/openssl/asn1.rb

@@ -376,25 +376,26 @@ def der_value
     end
 
     class UTCTime < Primitive
-      FORMAT = "%y%m%d%H%M%SZ".freeze
-
       private
 
+      YEAR_RANGE = 1950..2049
+      private_constant :YEAR_RANGE
+
       # :nodoc:
       def der_value
         value = if @value.is_a?(Time)
           @value
         else
           Time.at(Integer(@value))
-        end
+        end.utc
+
+        raise OpenSSL::ASN1::ASN1Error unless YEAR_RANGE.include?(value.year)
 
-        value.utc.strftime(FORMAT)
+        value.strftime("%y%m%d%H%M%SZ")
       end
     end
 
     class GeneralizedTime < Primitive
-      FORMAT = "%Y%m%d%H%M%SZ".freeze
-
       private
 
       # :nodoc:
@@ -403,9 +404,12 @@ def der_value
           @value
         else
           Time.at(Integer(@value))
-        end
+        end.utc
+
+        # per  In X.680 (02/2021) section 46: the year has to be exactly 4 digits for GeneralizedTime.
+        raise OpenSSL::ASN1::ASN1Error unless value.year < 10_000
 
-        value.utc.strftime(FORMAT)
+        value.strftime("%Y%m%d%H%M%SZ")
       end
     end