SSL_GET_PEER_CERTIFICATE(3ossl)

💅 SSL_GET_PEER_CERTIFICATE — get the X509 certificate of the peer

Okay bestie, settle in, because this is a 3ossl page and it's honestly kind of a big deal — it's all about grabbing the actual X509 certificate that the other side of your TLS connection handed over. No cap.

---

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

X509 *SSL_get0_peer_certificate(const SSL *ssl);
X509 *SSL_get1_peer_certificate(const SSL *ssl);

Soooo here's the thing — the next function has been deprecated since OpenSSL 3.0, and you can hide it entirely by defining OPENSSL_API_COMPAT with a suitable version value. Go peek at openssl_user_macros(7) for the deets 🫶

X509 *SSL_get_peer_certificate(const SSL *ssl);

---

🌸 DESCRIPTION 🌸

These functions return a pointer to the X509 certificate the peer presented. That's it, that's the whole vibe.

If the peer did not present a certificate? NULL comes back. Sad but true 😭

---

🦋 NOTES 🦋

Blame the protocol definition for this one, not me: a TLS/SSL server will always send a certificate, if present. A client will only send one when it's explicitly requested to do so by the server (see SSL_CTX_set_verify(3)). And if an anonymous cipher is being used? No certificates are sent at all. Periodt.

⚠️ Okay this part is important, do NOT skip it: the fact that a certificate got returned tells you nothing about the verification state. Like, zero info. If you wanna know if it actually passed, use SSL_get_verify_result(3). That's the whole point of that function, iykyk.

Now let's talk reference counts, because this is where people get their whole life ruined:

• The reference count of the X509 object returned by SSL_get1_peer_certificate() is incremented by one, so it won't get destroyed when the session containing the peer certificate is freed. Which means… you gotta free it yourself with X509_free(). It's yours now, you own it, take care of it 💖
• The reference count of the X509 object returned by SSL_get0_peer_certificate() is not incremented — and you must not free it. Do not. I'm serious. Hands off. 🙈

And last but not least: SSL_get_peer_certificate() is an alias of SSL_get1_peer_certificate(). Same function, different name, iconic behaviour honestly 💅

---

🎀 RETURN VALUES 🎀

Here's what can come back at you:

• NULL — No certificate was presented by the peer, or no connection was established. Rough.
• Pointer to an X509 certificate — The return value points to the certificate presented by the peer. Slay ✨

---

🔥 SEE ALSO 🔥

ssl(7), SSL_get_verify_result(3), SSL_CTX_set_verify(3)

---

💜 HISTORY 💜

• SSL_get0_peer_certificate() and SSL_get1_peer_certificate() were added in 3.0.0 🌈
• SSL_get_peer_certificate() was deprecated in 3.0.0 💀

---

👑 COPYRIGHT 👑

Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

---

And that's the whole page, bestie 🫶 brought to you by OpenSSL 3.5.6, dated 2026-04-07, filed under SSL_GET_PEER_CERTIFICATE(3ossl). Go forth and free your X509 objects responsibly ✨🎀