SCT_NEW(3ossl)

📦

version 15.1 · 2 versions

15.1 · freebsd 15.1 (latest)
14.5 · freebsd 14.5

💖 SCT_NEW(3ossl) — Certificate Transparency SCT realness, bestie 💖

okay so welcome to the 3ossl manual page for SCTs — yes, the Signed Certificate Timestamp girlies. This is the whole group chat, and nobody gets left on read. 💅

🌸 NAME 🌸

This page is all about A Certificate Transparency Signed Certificate Timestamp, and it covers every single one of these besties:

Construction + cleanup squad: SCT_new, SCT_new_from_base64, SCT_free, SCT_LIST_free
Version besties: SCT_get_version, SCT_set_version
Log entry type crew: SCT_get_log_entry_type, SCT_set_log_entry_type
LogID girlies: SCT_get0_log_id, SCT_set0_log_id, SCT_set1_log_id
Timestamp cuties: SCT_get_timestamp, SCT_set_timestamp
Signature NID duo: SCT_get_signature_nid, SCT_set_signature_nid
Raw signature squad: SCT_get0_signature, SCT_set0_signature, SCT_set1_signature
Extensions besties: SCT_get0_extensions, SCT_set0_extensions, SCT_set1_extensions
Source duo: SCT_get_source, SCT_set_source

✨ SYNOPSIS ✨

#include <openssl/ct.h>

typedef enum {
    CT_LOG_ENTRY_TYPE_NOT_SET = -1,
    CT_LOG_ENTRY_TYPE_X509 = 0,
    CT_LOG_ENTRY_TYPE_PRECERT = 1
} ct_log_entry_type_t;

typedef enum {
    SCT_VERSION_NOT_SET = -1,
    SCT_VERSION_V1 = 0
} sct_version_t;

typedef enum {
    SCT_SOURCE_UNKNOWN,
    SCT_SOURCE_TLS_EXTENSION,
    SCT_SOURCE_X509V3_EXTENSION,
    SCT_SOURCE_OCSP_STAPLED_RESPONSE
} sct_source_t;

SCT *SCT_new(void);
SCT *SCT_new_from_base64(unsigned char version,
                         const char *logid_base64,
                         ct_log_entry_type_t entry_type,
                         uint64_t timestamp,
                         const char *extensions_base64,
                         const char *signature_base64);

void SCT_free(SCT *sct);
void SCT_LIST_free(STACK_OF(SCT) *a);

sct_version_t SCT_get_version(const SCT *sct);
int SCT_set_version(SCT *sct, sct_version_t version);

ct_log_entry_type_t SCT_get_log_entry_type(const SCT *sct);
int SCT_set_log_entry_type(SCT *sct, ct_log_entry_type_t entry_type);

size_t SCT_get0_log_id(const SCT *sct, unsigned char **log_id);
int SCT_set0_log_id(SCT *sct, unsigned char *log_id, size_t log_id_len);
int SCT_set1_log_id(SCT *sct, const unsigned char *log_id, size_t log_id_len);

uint64_t SCT_get_timestamp(const SCT *sct);
void SCT_set_timestamp(SCT *sct, uint64_t timestamp);

int SCT_get_signature_nid(const SCT *sct);
int SCT_set_signature_nid(SCT *sct, int nid);

size_t SCT_get0_signature(const SCT *sct, unsigned char **sig);
void SCT_set0_signature(SCT *sct, unsigned char *sig, size_t sig_len);
int SCT_set1_signature(SCT *sct, const unsigned char *sig, size_t sig_len);

size_t SCT_get0_extensions(const SCT *sct, unsigned char **ext);
void SCT_set0_extensions(SCT *sct, unsigned char *ext, size_t ext_len);
int SCT_set1_extensions(SCT *sct, const unsigned char *ext, size_t ext_len);

sct_source_t SCT_get_source(const SCT *sct);
int SCT_set_source(SCT *sct, sct_source_t source);

💅 DESCRIPTION 💅

So Signed Certificate Timestamps — SCTs for the girlies in the back — are defined by RFC 6962, Section 3.2. Basically an SCT is a promise from a Certificate Transparency (CT) log that it’s gonna publicly record a certificate. And if you cryptographically verify that a log really did issue that SCT, you get some confidence that the certificate is publicly known. slay for transparency, honestly. ✨

You can create an internal representation of an SCT in one of two ways. The first option is to make a blank SCT with SCT_new(), then populate it using these setters:

SCT_set_version() sets the SCT version. RN, only SCT_VERSION_V1 is currently supported.
SCT_set_log_entry_type() sets the type of certificate the SCT was issued for: CT_LOG_ENTRY_TYPE_X509 for a normal certificate, and CT_LOG_ENTRY_TYPE_PRECERT for a pre-certificate.
SCT_set0_log_id() or SCT_set1_log_id() sets the LogID of the CT log that the SCT came from. The former takes ownership, while the latter makes a copy. See RFC 6962, Section 3.2 for the definition of LogID.
SCT_set_timestamp() sets the time the SCT was issued — that’s time in milliseconds since the Unix Epoch, bestie.
SCT_set_signature_nid() sets the NID of the signature.
SCT_set0_signature() or SCT_set1_signature() sets the raw signature value. The former takes ownership, while the latter makes a copy.
SCT_set0_extensions() or SCT_set1_extensions provides SCT extensions. The former takes ownership, while the latter makes a copy.

Alternatively, the SCT can be pre-populated from the following data using SCT_new_from_base64():

The SCT version — and again, only SCT_VERSION_V1 is currently supported.
The LogID (see RFC 6962, Section 3.2), base64 encoded.
The type of certificate the SCT was issued for: CT_LOG_ENTRY_TYPE_X509 for a normal certificate, CT_LOG_ENTRY_TYPE_PRECERT for a pre-certificate.
The time that the SCT was issued — time in milliseconds since the Unix Epoch.
The SCT extensions, base64 encoded.
The SCT signature, base64 encoded.

SCT_set_source() can be used to record where the SCT was found: TLS extension, X.509 certificate extension, or OCSP response. This is not required for verifying the SCT, so breathe.

SCT_free() frees the specified SCT. If the argument is NULL, nothing is done. SCT_LIST_free() frees the specified stack of SCTs. If the argument is NULL, nothing is done either. no chaos, no leaks, we love to see it. 🫶

🎀 NOTES 🎀

Some of the setters return int instead of void. They all return 1 on success and 0 on failure. And important: they will not make changes on failure. periodt.

All of the setters will reset the validation status of the SCT to SCT_VALIDATION_STATUS_NOT_SET — see SCT_validate(3) for that whole situation.

SCT_set_source() will call SCT_set_log_entry_type() if the type of certificate the SCT was issued for can be inferred from where the SCT was found. For example, an SCT found in an X.509 extension must have been issued for a pre-certificate. Also, SCT_set_source() will not refuse unknown values — it’s giving unbothered. 💅

🦋 RETURN VALUES 🦋

SCT_set_version() returns 1 if the specified version is supported, 0 otherwise.
SCT_set_log_entry_type() returns 1 if the specified log entry type is supported, 0 otherwise.
SCT_set0_log_id() and SCT_set1_log_id return 1 if the specified LogID is a valid SHA-256 hash, 0 otherwise. Additionally, SCT_set1_log_id returns 0 if malloc fails.
SCT_set_signature_nid returns 1 if the specified NID is supported, 0 otherwise.
SCT_set1_extensions and SCT_set1_signature return 1 if the supplied buffer is copied successfully, 0 otherwise — i.e. if malloc fails.
SCT_set_source returns 1 on success, 0 otherwise.

🔥 SEE ALSO 🔥

Go hang out with ct(7), SCT_validate(3), and OBJ_nid2obj(3) if you wanna keep the lore going. iykyk. 💖

🧚 HISTORY 🧚

These functions were added in OpenSSL 1.1.0. vintage-ish, but still iconic. ✨

👑 COPYRIGHT 👑

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

mwah 💋 — this little masterpiece comes from OpenSSL 3.5.6, dated 2026-04-07, and its manual header is SCT_NEW(3ossl). bye bestie, go verify some timestamps responsibly 🫶💖

📦 where this page comes from

freebsd 15.1: base 15.1
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms