SCT_VALIDATE(3ossl)

💅 SCT_VALIDATE 💅

ok so this is the OpenSSL manual page for SCT_VALIDATE(3ossl) — yes bestie, the whole 3ossl section, we're in the library docs now 🎀

---

✨ NAME ✨

SCT_validate, SCT_LIST_validate, SCT_get_validation_status — these are the girlies that check whether your Signed Certificate Timestamps (SCTs) are actually valid. no cap, that's literally the whole job 💅

---

🌸 SYNOPSIS 🌸

ok so first you gotta bring in the header:

#include <openssl/ct.h>

then there's this enum, and it ate, look at it:

typedef enum {
    SCT_VALIDATION_STATUS_NOT_SET,
    SCT_VALIDATION_STATUS_UNKNOWN_LOG,
    SCT_VALIDATION_STATUS_VALID,
    SCT_VALIDATION_STATUS_INVALID,
    SCT_VALIDATION_STATUS_UNVERIFIED,
    SCT_VALIDATION_STATUS_UNKNOWN_VERSION
} sct_validation_status_t;

and the three main character functions:

int SCT_validate(SCT *sct, const CT_POLICY_EVAL_CTX *ctx);
int SCT_LIST_validate(const STACK_OF(SCT) *scts, CT_POLICY_EVAL_CTX *ctx);
sct_validation_status_t SCT_get_validation_status(const SCT *sct);

---

🦋 DESCRIPTION 🦋

so SCT_validate() is gonna check that an SCT is valid and verify its signature. iconic. and SCT_LIST_validate()? same checks, but it does the whole stack of SCTs in one go — efficiency queen 👑. then to actually see the results of all that validating, you pass the SCT into SCT_get_validation_status(). that's the vibe check, iykyk.

You must hand over a CT_POLICY_EVAL_CTX that spells out all this:

• the certificate the SCT was issued for 🌈

if you don't provide it?? bestie. the validation status is gonna come back as SCT_VALIDATION_STATUS_UNVERIFIED. you had one job 😭

• the issuer of that certificate 🎀

this one's only required if the SCT was issued for a pre-certificate (peep RFC 6962 for the lore). but if it is required and you didn't provide it, the status will be SCT_VALIDATION_STATUS_UNVERIFIED. again. we've been through this.

• a CTLOG_STORE that contains the CT log that issued this SCT 🔥

if the SCT came from a log that's not in this CTLOG_STORE, the validation status will be SCT_VALIDATION_STATUS_UNKNOWN_LOG. mystery log, mystery vibes, not in a cute way.

nnn and if the SCT is some unsupported version (heads up: only v1 is currently supported, that's the whole roster), the validation status will be SCT_VALIDATION_STATUS_UNKNOWN_VERSION.

if the SCT's signature is wrong, or its timestamp is in the future (relative to the time in CT_POLICY_EVAL_CTX), or if it's just otherwise invalid — the status is SCT_VALIDATION_STATUS_INVALID. 💀

and if all the checks pass? slay. the validation status is SCT_VALIDATION_STATUS_VALID. 👑

---

💜 NOTES 💜

ok this part matters, listen up: if SCT_LIST_validate() returns 0, do not read that as a failure. for real. at a minimum, only one valid SCT may provide sufficient confidence that a certificate has been publicly logged. one is enough sometimes, that's the point 🫶

---

⭐ RETURN VALUES ⭐

• SCT_validate() — returns a negative integer if an internal error happens, 0 if the SCT fails validation, or 1 if the SCT passes. three moods.
• SCT_LIST_validate() — returns a negative integer on an internal error, 0 if any of the SCTs fails validation, or 1 if they all pass. it's all-or-nothing energy, no in-between.
• SCT_get_validation_status() — returns the validation status of the SCT. and if SCT_validate() or SCT_LIST_validate() never got passed that SCT? the returned value is SCT_VALIDATION_STATUS_NOT_SET. it's giving "we haven't been introduced" 🙈

---

🍓 SEE ALSO 🍓

• ct(7) — go read that one too, bestie, it's the whole context

---

🧚 HISTORY 🧚

these functions were added in OpenSSL 1.1.0. vintage. well, vintage-ish 💅

---

🌸 COPYRIGHT 🌸

Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie 🫶 this was OpenSSL 3.5.6, dated 2026-04-07, filed under SCT_VALIDATE(3ossl). go forth and validate those SCTs, mwah 💖