X509_CHECK_CA(3ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

Hey bestie, welcome to the X509_CHECK_CA(3ossl) page 💖 this is your group-chat explainer for X509_check_ca, no cap.

✨ NAME ✨

X509_check_ca — check if given certificate is CA certificate 👑

Okay so this whole page is about one function, X509_check_ca, and it's literally doing the vibe check: is this certificate a CA certificate? That's the whole assignment. 💅

🌸 SYNOPSIS 🌸

#include <openssl/x509v3.h>

int X509_check_ca(X509 *cert);

So you pull in <openssl/x509v3.h>, then you call X509_check_ca(cert) with your X509 *cert. Easy. ✨

🦋 DESCRIPTION 🦋

This function checks if the given certificate is a CA certificate — meaning it can be used to sign other certificates. That's the main-character job of a CA cert, bestie. 🫶

The certificate must be a complete certificate, otherwise an error is returned. So don't slide in with half a cert and expect magic, okay? 😭

💅 RETURN VALUES 💅

The return values are doing a little numbered lineup, and every one matters:

  • 0 — nope, it is not a CA certificate.
  • 1 — yes bestie, it is a proper X509v3 CA certificate with the basicConstraints extension CA:TRUE. 👑
  • 3 — it is a self-signed X509 v1 certificate.
  • 4 — it is a certificate with the keyUsage extension with bit keyCertSign set, but without basicConstraints.
  • 5 — it has the outdated Netscape Certificate Type extension telling that it is a CA certificate.

Also: this function will also return 0 on error. So 0 is doing double duty — "not CA" and "oops, error" — which is lowkey chaotic, but that's the tea. 🍵

And actually, any nonzero value means that this certificate could have been used to sign other certificates. So nonzero = "could've signed stuff", periodt. 🔥

🌈 SEE ALSO 🌈

Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

That's the whole page, bestie 💜 cute sign-off time: this manual page is from OpenSSL 3.5.6, dated 2026-04-07. Go forth and check those CAs. 🎀✨

📦 where this page comes from