SSL_CTX_ADD_EXTRA_CHAIN_CERT(3ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💅 SSL_CTX_ADD_EXTRA_CHAIN_CERT 💅

okay so this is the 3ossl manual page, and today we're talking about the four little chain-certificate besties: SSL_CTX_add_extra_chain_cert, SSL_CTX_get_extra_chain_certs, SSL_CTX_get_extra_chain_certs_only, and SSL_CTX_clear_extra_chain_certs. they add, get, and clear extra chain certificates. that's the whole vibe. 🎀

✨ NAME ✨

SSL_CTX_add_extra_chain_cert, SSL_CTX_get_extra_chain_certs, SSL_CTX_get_extra_chain_certs_only, SSL_CTX_clear_extra_chain_certs — add, get or clear extra chain certificates 🦋

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

long SSL_CTX_add_extra_chain_cert(SSL_CTX *ctx, X509 *x509);
long SSL_CTX_get_extra_chain_certs(SSL_CTX *ctx, STACK_OF(X509) **sk);
long SSL_CTX_get_extra_chain_certs_only(SSL_CTX *ctx, STACK_OF(X509) **sk);
long SSL_CTX_clear_extra_chain_certs(SSL_CTX *ctx);

💖 DESCRIPTION 💖

  • SSL_CTX_add_extra_chain_cert() — adds the certificate x509 to the extra chain certificates chillin' with ctx. and like, you can add several certificates, one after another. no cap, just keep stacking 'em. ✨
  • SSL_CTX_get_extra_chain_certs() — retrieves the extra chain certificates associated with ctx, or, if the extra chain is empty, it gives you the chain associated with the current certificate of ctx. the returned stack should not be freed by the caller. not me watching you try to free it — don't. 🙈
  • SSL_CTX_get_extra_chain_certs_only() — retrieves the extra chain certificates associated with ctx. same deal: the returned stack should not be freed by the caller. 💅
  • SSL_CTX_clear_extra_chain_certs() — clears all extra chain certificates associated with ctx. poof, gone, main character exit. 🫶

also, important: these functions are implemented as macros. iykyk.

🦋 NOTES 🦋

when sending a certificate chain, extra chain certificates are sent in order following the end entity certificate. order matters, bestie. 🎀

if no chain is specified, the library will try to complete the chain from the available CA certificates in the trusted CA storage — see SSL_CTX_load_verify_locations(3). it's giving helpful. ✨

🚨 the x509 certificate provided to SSL_CTX_add_extra_chain_cert() will be freed by the library when the SSL_CTX is destroyed. an application should not free the x509 object. literally do not touch it. that's the library's certificate now. 😭

🔥 RESTRICTIONS 🔥

only one set of extra chain certificates can be specified per SSL_CTX structure. that's the rule, periodt. 💀

so different chains for different certificates — for example if both RSA and DSA certificates are specified by the same server — or different SSL structures with the same parent SSL_CTX, cannot be specified using this function. nope, not happening with this one.

for more flexibility, functions such as SSL_add1_chain_cert() should be used instead. slay, there are options. 👑

⭐ RETURN VALUES ⭐

SSL_CTX_add_extra_chain_cert() and SSL_CTX_clear_extra_chain_certs() return 1 on success and 0 for failure. and if it fails? check out the error stack to find out the reason. the error stack is literally telling you what's wrong, bestie, listen to it. 🍓

🌈 SEE ALSO 🌈

copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved. 💜

licensed under the Apache License 2.0 (the "License"). you may not use this file except in compliance with the License. you can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, bestie, you ate that 🧚✨ this little gem is from version 3.5.6, dated 2026-04-0 — mwah, go forth and chain your certs responsibly 💅💖

📦 where this page comes from