Fails to build with OpenSSL 4.0

[sebastic]

As reported in Debian Bug #1138304:

OpenSSL 4.0 is in experimental. This package fails to build against it:

| /build/reproducible-path/icinga2-2.15.2/lib/base/tlsutility.cpp: In function ‘icinga::String icinga::GetCertificateCN(const std::shared_ptr<x509_st>&)’:
| /build/reproducible-path/icinga2-2.15.2/lib/base/tlsutility.cpp:431:51: error: invalid conversion from ‘const X509_NAME*’ {aka ‘const X509_name_st*’} to ‘X509_NAME*’ {aka ‘X509_name_st*’} [-fpermissive]
|   431 |         return GetX509NameCN(X509_get_subject_name(certificate.get()));
|       |                              ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~
|       |                                                   |
|       |                                                   const X509_NAME* {aka const X509_name_st*}
| /build/reproducible-path/icinga2-2.15.2/lib/base/tlsutility.cpp:591:60: error: invalid conversion from ‘const X509_NAME*’ {aka ‘const X509_name_st*’} to ‘X509_NAME*’ {aka ‘X509_name_st*’} [-fpermissive]
|   591 |                 X509_NAME *name = X509_REQ_get_subject_name(req);
|       |                                   ~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~
|       |                                                            |
|       |                                                            const X509_NAME* {aka const X509_name_st*}
| /build/reproducible-path/icinga2-2.15.2/lib/base/tlsutility.cpp:768:65: error: invalid conversion from ‘const X509_NAME*’ {aka ‘const X509_name_st*’} to ‘X509_NAME*’ {aka ‘X509_name_st*’} [-fpermissive]
|   768 |         return CreateCert(pubkey, subject, X509_get_subject_name(cacert.get()), privkey, ca);
|       |                                            ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~
|       |                                                                 |
|       |                                                                 const X509_NAME* {aka const X509_name_st*}
| /build/reproducible-path/icinga2-2.15.2/lib/base/tlsutility.cpp:643:83: note: initializing argument 3 of ‘std::shared_ptr<x509_st> icinga::CreateCert(EVP_PKEY*, X509_NAME*, X509_NAME*, EVP_PKEY*, bool)’
|   643 | std::shared_ptr<X509> CreateCert(EVP_PKEY *pubkey, X509_NAME *subject, X509_NAME *issuer, EVP_PKEY *cakey, bool ca)
|       |                                                                        ~~~~~~~~~~~^~~~~~
| /build/reproducible-path/icinga2-2.15.2/lib/base/tlsutility.cpp: In function ‘std::shared_ptr<x509_st> icinga::CreateCertIcingaCA(const std::shared_ptr<x509_st>&)’:
| /build/reproducible-path/icinga2-2.15.2/lib/base/tlsutility.cpp:774:68: error: invalid conversion from ‘const X509_NAME*’ {aka ‘const X509_name_st*’} to ‘X509_NAME*’ {aka ‘X509_name_st*’} [-fpermissive]
|   774 |         return CreateCertIcingaCA(pkey.get(), X509_get_subject_name(cert.get()));
|       |                                               ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~
|       |                                                                    |
|       |                                                                    const X509_NAME* {aka const X509_name_st*}
| /build/reproducible-path/icinga2-2.15.2/lib/base/tlsutility.cpp:731:71: note: initializing argument 2 of ‘std::shared_ptr<x509_st> icinga::CreateCertIcingaCA(EVP_PKEY*, X509_NAME*, bool)’
|   731 | std::shared_ptr<X509> CreateCertIcingaCA(EVP_PKEY *pubkey, X509_NAME *subject, bool ca)
|       |                                                            ~~~~~~~~~~~^~~~~~~

Full buildlog
https://breakpoint.cc/openssl-rebuild/logs-4/attempted/icinga2_2.15.2-2_amd64-2026-04-19T09:08:24Z

Relevant changes seems to be: ossl-guide-migration - Constification of X509 functions