X509_DIGEST(3ossl)

💅 X509_DIGEST 💅

okay bestie, this is the OpenSSL manpage X509_DIGEST(3ossl) and it's literally all about getting digests of various objects. no cap, it's a good one. 🎀

---

✨ NAME ✨

X509_digest, X509_digest_sig, X509_CRL_digest, X509_pubkey_digest, X509_NAME_digest, X509_REQ_digest, PKCS7_ISSUER_AND_SERIAL_digest — get digest of various objects 🦋

---

🌸 SYNOPSIS 🌸

#include <openssl/x509.h>

int X509_digest(const X509 *data, const EVP_MD *type, unsigned char *md,
                unsigned int *len);
ASN1_OCTET_STRING *X509_digest_sig(const X509 *cert,
                                   EVP_MD **md_used, int *md_is_fallback);

int X509_CRL_digest(const X509_CRL *data, const EVP_MD *type, unsigned char *md,
                    unsigned int *len);

int X509_pubkey_digest(const X509 *data, const EVP_MD *type,
                       unsigned char *md, unsigned int *len);

int X509_REQ_digest(const X509_REQ *data, const EVP_MD *type,
                    unsigned char *md, unsigned int *len);

int X509_NAME_digest(const X509_NAME *data, const EVP_MD *type,
                     unsigned char *md, unsigned int *len);

#include <openssl/pkcs7.h>

int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data,
                                   const EVP_MD *type, unsigned char *md,
                                   unsigned int *len);

---

💖 DESCRIPTION 💖

so X509_digest_sig() is the main character here ngl — it calculates a digest of the given certificate cert using the same hash algorithm as in its signature, but only if the digest is an integral part of the certificate signature algorithm identifier. ✨

if it's not, a fallback hash algorithm gets picked like this, bestie:

• SHA512 if the signature algorithm is ED25519
• SHAKE256 if it's ED448
• otherwise, SHA256 (the default-default, the safe little guy 🫶)

then the output parameters get assigned, and here's the tea:

• unless md_used is NULL, the hash algorithm used is provided in *md_used — and the caller must free it (if it is not NULL). yes, that means you. 👀
• unless md_is_fallback is NULL, *md_is_fallback is set to 1 if the hash algorithm used is a fallback, otherwise to 0.

X509_pubkey_digest() returns a digest of the DER representation of the public key in the specified X509 data object. just the pubkey, not the whole thing. 🔑

all the other functions described here return a digest of the DER representation of their entire data objects. the whole vibe. the full package. 💅

the type parameter specifies the digest to be used, such as EVP_sha1(). the md is a pointer to the buffer where the digest will be copied and is assumed to be large enough — the constant EVP_MAX_MD_SIZE is suggested (please use it, don't raw-dog your buffer size 😭). the len parameter, if not NULL, points to a place where the digest size will be stored. 🎀

---

⭐ RETURN VALUES ⭐

• X509_digest_sig() returns an ASN1_OCTET_STRING pointer on success, else NULL. iconic when it works, tragic when it doesn't. 😭
• all other functions described here return 1 for success and 0 for failure. classic.

---

🌈 SEE ALSO 🌈

EVP_sha1(3) — go read it, iykyk 🦋

---

🧚 HISTORY 🧚

the X509_digest_sig() function was added in OpenSSL 3.0. she's a newer era queen. 👑

---

👑 COPYRIGHT 👑

Copyright 2017-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

fr fr read the license before you go copying stuff, bestie 💀

---

and that's the whole page, bestie!! 🍓 this was version 3.5.6, dated 2026-04-07, from the OpenSSL fam — now go digest something, slay, periodt 💜✨🎀