X509_ADD_CERT(3ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💅 X509_ADD_CERT(3ossl) — the X509 cert list addition functions, but make it make sense ✨

Okay bestie, real talk: if you've ever been like "how do I just add a certificate to a list without messing everything up," this is the page for you. We're talking X509_add_cert and X509_add_certs — two little functions from x509.h that do exactly what they say on the tin, no cap.

This is a 3ossl manpage, so yes, we're in OpenSSL land. Slay. 💖

🌸 SYNOPSIS 🌸

#include <openssl/x509.h>

int X509_add_cert(STACK_OF(X509) *sk, X509 *cert, int flags);
int X509_add_certs(STACK_OF(X509) *sk, STACK_OF(X509) *certs, int flags);

🎀 DESCRIPTION 🎀

So here's the vibe. X509_add_cert() adds a cert to a given list called sk. And bestie, listen: if you pass NULL as the cert argument? That's an error. It is not the moment. 🚫

Then we have X509_add_certs(), which adds a whole list of certs to sk. The certs argument is allowed to be NULL, which literally just means "no effect" — like when someone says "I'll be there" and then isn't. It doesn't modify the certs list, but lowkey here's the tea: if the X509_ADD_FLAG_UP_REF flag is set (we'll get to that), then the reference counters of the members that get added to sk are increased. So that's a thing. 👀

Both functions take a flags parameter, which controls the details. Main character energy for that little int.

  • X509_ADD_FLAG_DEFAULT, which equals 0, means no special semantics. It's the "just vibes" flag.
  • If X509_ADD_FLAG_UP_REF is set, then the reference counts of the certs that get added successfully are increased. Like giving them a little boost. 🆙
  • If X509_ADD_FLAG_PREPEND is set, then the certs are prepended to sk. By default they're appended to sk. In both cases the original order of the added certs is preserved — so no chaotic shuffling, periodt.
  • If X509_ADD_FLAG_NO_DUP is set, then certs already in sk — determined using X509_cmp(3) — are ignored. We don't do duplicates here. 🙅‍♀️
  • If X509_ADD_FLAG_NO_SS is set, then certs marked as self-signed — determined using X509_self_signed(3) — are ignored. Self-signed? Not today, bestie. ✋

🔥 RETURN VALUES 🔥

Both functions return 1 for success and 0 for failure. That's it. That's the whole vibe check. 🫶

💀 NOTES 💀

Okay this part is important so pay attention. If you use X509_add_certs() with the flags X509_ADD_FLAG_NO_DUP or X509_ADD_FLAG_NO_SS, it is advisable to also use X509_ADD_FLAG_UP_REF. Why? Because otherwise it's likely that not for all members of the certs list is the ownership transferred to the list of certificates sk. Like, some of them just won't make it into the group chat. 😭 So yeah, use UP_REF. Trust.

Also: care should be taken in case the certs argument equals sk. Just… be careful. This is giving "don't text your ex" energy. 🙈

🦋 SEE ALSO 🦋

Go read those too if you wanna be fully literate in X509. iykyk. 📚✨

⭐ HISTORY ⭐

The functions X509_add_cert() and X509_add_certs() were added in OpenSSL 3.0. So if you're on something older, sorry bestie, you're out of luck. 💔

Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

And that's the whole page, bestie. Written by the OpenSSL project, version 3.5.6, dated 2026-04-07. Slay, stay certified, and remember: don't pass NULL to X509_add_cert. Periodt. 💅💖✨

📦 where this page comes from