The issue arises from the use of the -addreject option with the openssl x509 application, which adds a trusted use instead of a rejected use for a certificate. This means if a user intends to make a trusted certificate rejected for a particular use, it will be instead marked as trusted for that use. The problem was introduced by a copy & paste error during minor refactoring of the code in the OpenSSL 3.5 version. Only users who use the trusted certificate format and the openssl x509 command line application to add rejected uses are affected.