X509_NAME_PRINT_EX(3ossl)

📦
version 15.1 · 2 versions
, in freebsd 15.1

💖 NAME 💖

X509_NAME_print_ex, X509_NAME_print_ex_fp, X509_NAME_print, X509_NAME_oneline — bestie, these are the X509_NAME printing routines, and okay yes the name of this whole page is X509_NAME_PRINT_EX(3ossl) (OpenSSL, obvi) but like, sit down, we're gonna go through all four 💅

✨ SYNOPSIS ✨

#include <openssl/x509.h>

int X509_NAME_print_ex(BIO *out, const X509_NAME *nm,
                       int indent, unsigned long flags);
int X509_NAME_print_ex_fp(FILE *fp, const X509_NAME *nm,
                          int indent, unsigned long flags);
char *X509_NAME_oneline(const X509_NAME *a, char *buf, int size);
int X509_NAME_print(BIO *bp, const X509_NAME *name, int obase);

🌸 DESCRIPTION 🌸

X509_NAME_print_ex() prints a human readable version of nm out to the BIO out. Every line (the multiline formats, bestie, not the one-liners) gets indented by indent spaces. And the flags parameter? That's the whole personality knob — you can customise the output format extensively with it 🎀

X509_NAME_print_ex_fp() is literally identical to X509_NAME_print_ex() except the output goes to a FILE pointer fp instead. Same energy, different destination 🦋

X509_NAME_oneline() prints an ASCII version of a to buf. It supports multi-valued RDNs and escapes / and + characters in values. And here's the cute part: if buf is NULL, then a buffer gets dynamically allocated and returned to you, and size is just ignored. Otherwise, at most size bytes get written, including the ending '\0', and buf is what comes back 🫶

X509_NAME_print() prints name to bp on a single line. The obase parameter is ignored — it's only still there for API compatibility, lowkey a fossil 💀

⭐ NOTES ⭐

Okay so, real talk: X509_NAME_oneline() and X509_NAME_print() produce a non standard output form, they don't handle multi-character fields, and they have various quirks and inconsistencies. Their use is strongly discouraged in new applications and they could be deprecated in a future release. So like… don't, bestie 😭

Now — although there are a large number of possible flags, for most purposes XN_FLAG_ONELINE, XN_FLAG_MULTILINE or XN_FLAG_RFC2253 will suffice. Iconic, we love a shortcut 👑

As noted on the ASN1_STRING_print_ex(3) manual page, for UTF8 terminals the ASN1_STRFLGS_ESC_MSB should be unset: so for example XN_FLAG_ONELINE & ~ASN1_STRFLGS_ESC_MSB would be used. No cap, that's the move ✨

The complete set of the flags supported by X509_NAME_print_ex() is listed below. Several options can be ored together 💜

🎀 The separator flags

The options XN_FLAG_SEP_COMMA_PLUS, XN_FLAG_SEP_CPLUS_SPC, XN_FLAG_SEP_SPLUS_SPC and XN_FLAG_SEP_MULTILINE determine the field separators to use. Two distinct separators are used: one between distinct RelativeDistinguishedName components, and one to separate values in the same RDN for a multi-valued RDN. Multi-valued RDNs are currently very rare so the second separator will hardly ever be used 🙈

  • XN_FLAG_SEP_COMMA_PLUS — uses comma and plus as separators.
  • XN_FLAG_SEP_CPLUS_SPC — uses comma and plus with spaces: this is more readable than plain comma and plus. It's givinggg ✨
  • XN_FLAG_SEP_SPLUS_SPC — uses spaced semicolon and plus.
  • XN_FLAG_SEP_MULTILINE — uses spaced newline and plus respectively.

🦋 Order, names, spacing

  • XN_FLAG_DN_REV — if set, the whole DN is printed in reversed order. Main character energy, backwards 💅

The fields XN_FLAG_FN_SN, XN_FLAG_FN_LN, XN_FLAG_FN_OID, XN_FLAG_FN_NONE determine how a field name is displayed:

  • XN_FLAG_FN_SN — will use the short name (e.g. CN).
  • XN_FLAG_FN_LN — will use the long name (e.g. commonName).
  • XN_FLAG_FN_OID — always use OID numerical form (normally OIDs are only used if the field name is not recognised).
  • XN_FLAG_FN_NONE — no field name respectively.
  • XN_FLAG_SPC_EQ — if set, then spaces will be placed around the '=' character separating field names and values. Spacing is self care 🫶
  • XN_FLAG_DUMP_UNKNOWN_FIELDS — if set, then the encoding of unknown fields is printed instead of the values.
  • XN_FLAG_FN_ALIGN — if set, then field names are padded to 20 characters: this is only of use for multiline format.

Additionally all the options supported by ASN1_STRING_print_ex() can be used to control how each field value is displayed.

🌈 The preset combo flags

In addition a number options can be set for commonly used formats. These are the pre-made fits, iykyk 🔥

XN_FLAG_RFC2253 sets options which produce an output compatible with RFC2253. It is equivalent to:

"ASN1_STRFLGS_RFC2253 | XN_FLAG_SEP_COMMA_PLUS | XN_FLAG_DN_REV
  | XN_FLAG_FN_SN | XN_FLAG_DUMP_UNKNOWN_FIELDS"

XN_FLAG_ONELINE is a more readable one line format which is the same as:

"ASN1_STRFLGS_RFC2253 | ASN1_STRFLGS_ESC_QUOTE | XN_FLAG_SEP_CPLUS_SPC
  | XN_FLAG_SPC_EQ | XN_FLAG_FN_SN"

XN_FLAG_MULTILINE is a multiline format which is the same as:

"ASN1_STRFLGS_ESC_CTRL | ASN1_STRFLGS_ESC_MSB | XN_FLAG_SEP_MULTILINE
  | XN_FLAG_SPC_EQ | XN_FLAG_FN_LN | XN_FLAG_FN_ALIGN"

XN_FLAG_COMPAT uses a format identical to X509_NAME_print(): in fact it calls X509_NAME_print() internally. Sneaky little callback, honestly 💀

👑 RETURN VALUES 👑

  • X509_NAME_oneline() returns a valid string on success or NULL on error.
  • X509_NAME_print() returns 1 on success or 0 on error.
  • X509_NAME_print_ex() and X509_NAME_print_ex_fp() return 1 on success or 0 on error if the XN_FLAG_COMPAT is set, which is the same as X509_NAME_print(). Otherwise, it returns -1 on error or other values on success.
Not me having to warn you: the return value of X509_NAME_print_ex() and X509_NAME_print_ex_fp() is not your usual 1/0 situation unless XN_FLAG_COMPAT is set. Read that last bullet twice, bestie 😭

⭐ SEE ALSO ⭐

Copyright 2002-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

That's the whole page, bestie — signed, sealed, delivered by OpenSSL version 3.5.6, dated 2026-04-07, and filed under X509_NAME_PRINT_EX(3ossl). Now go print some names, slay 💖🌈🦋

📦 where this page comes from