diff --git a/crypto/x509/x509_set.c b/crypto/x509/x509_set.c
index 0aa92bd..5242e34 100644
--- a/crypto/x509/x509_set.c
+++ b/crypto/x509/x509_set.c
@@ -129,6 +129,14 @@
     return x->cert_info->validity->notBefore;
 }
 
+ASN1_TIME *X509_getm_notBefore(X509 *x)
+{
+    // Note this function takes a const |X509| pointer in OpenSSL. We require
+    // non-const as this allows mutating |x|. If it comes up for compatibility,
+    // we can relax this.
+    return x->cert_info->validity->notBefore;
+}
+
 int X509_set_notAfter(X509 *x, const ASN1_TIME *tm)
 {
     ASN1_TIME *in;
@@ -151,6 +159,14 @@
     return x->cert_info->validity->notAfter;
 }
 
+ASN1_TIME *X509_getm_notAfter(X509 *x)
+{
+    // Note this function takes a const |X509| pointer in OpenSSL. We require
+    // non-const as this allows mutating |x|. If it comes up for compatibility,
+    // we can relax this.
+    return x->cert_info->validity->notAfter;
+}
+
 int X509_set_pubkey(X509 *x, EVP_PKEY *pkey)
 {
     if ((x == NULL) || (x->cert_info == NULL))
diff --git a/include/openssl/x509.h b/include/openssl/x509.h
index ee3eccc..438212c 100644
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h
@@ -829,8 +829,10 @@
 OPENSSL_EXPORT X509_NAME *	X509_get_subject_name(X509 *a);
 OPENSSL_EXPORT int 		X509_set_notBefore(X509 *x, const ASN1_TIME *tm);
 OPENSSL_EXPORT const ASN1_TIME *X509_get0_notBefore(const X509 *x);
+OPENSSL_EXPORT ASN1_TIME *X509_getm_notBefore(X509 *x);
 OPENSSL_EXPORT int 		X509_set_notAfter(X509 *x, const ASN1_TIME *tm);
 OPENSSL_EXPORT const ASN1_TIME *X509_get0_notAfter(const X509 *x);
+OPENSSL_EXPORT ASN1_TIME *X509_getm_notAfter(X509 *x);
 OPENSSL_EXPORT int 		X509_set_pubkey(X509 *x, EVP_PKEY *pkey);
 OPENSSL_EXPORT EVP_PKEY *	X509_get_pubkey(X509 *x);
 OPENSSL_EXPORT ASN1_BIT_STRING * X509_get0_pubkey_bitstr(const X509 *x);