ACCESS_DESCRIPTION_NEW(3)

💅 ACCESS_DESCRIPTION_NEW(3) — like, the library functions manual, bestie

okay so this is a page from the Library Functions Manual and it's all about the X.509 information access extensions, and honestly? it's giving "certificates that know a guy." let's get into it 🎀

---

✨ NAME ✨

ACCESS_DESCRIPTION_new, ACCESS_DESCRIPTION_free, AUTHORITY_INFO_ACCESS_new, AUTHORITY_INFO_ACCESS_free — X.509 information access extensions 🌈

---

🌸 SYNOPSIS 🌸

library “libcrypto”

#include <openssl/x509v3.h>

ACCESS_DESCRIPTION *
ACCESS_DESCRIPTION_new(void);

void
ACCESS_DESCRIPTION_free(ACCESS_DESCRIPTION *ad);

AUTHORITY_INFO_ACCESS
AUTHORITY_INFO_ACCESS_new(void);

void
AUTHORITY_INFO_ACCESS_free(AUTHORITY_INFO_ACCESS *aia);

---

🦋 DESCRIPTION 🦋

so here's the vibe: using the information access extensions, certificates and certificate revocation lists can point to auxiliary information and services available online — for example online validation services or CA policy data. it's like a little hyperlink in your cert, no cap ✨

ACCESS_DESCRIPTION_new() allocates and initializes an empty ACCESS_DESCRIPTION object, representing an ASN.1 AccessDescription structure defined in RFC 5280 section 4.2.2.1. it can hold a pointer to a GENERAL_NAME object documented in GENERAL_NAME_new(3) and an access method identifier. ACCESS_DESCRIPTION_free() frees ad.

and like — the access method identifier is somewhat misnamed, ngl. it identifies the type and format of the information provided. how to actually access that information is often obvious from the GENERAL_NAME, which may for example include a uniform resource identifier. iykyk 💅

four standard access method identifiers are defined in RFC 5280:

• "id-ad-caIssuers" can occur in the authority information access extension of certificates and certificate revocation lists and provides access to certificates issued to the CA that issued the certificate, or provides access to certificates used for signing the CRL, in order to help constructing a certification path. 🔥
• "id-ad-ocsp" can occur in the authority information access extension of certificates and provides access to revocation information via the Online Certificate Status Protocol (OCSP) defined in RFC 6960.
• "id-ad-caRepository" can occur in the subject information access extension of CA certificates and provides access to an online repository of certificates issued by the CA. 🗂️
• "id-ad-timeStamping" can occur in the subject information access extension of end entity certificates and indicates that the subject offers timestamping services using the Time Stamp Protocol defined in RFC 3161.

AUTHORITY_INFO_ACCESS_new() allocates and initializes an empty AUTHORITY_INFO_ACCESS object, which is a STACK_OF(ACCESS_DESCRIPTION) and represents an ASN.1 AuthorityInfoAccessSyntax structure defined in RFC 5280 section 4.2.2.1. it can be used for the authority information access extension of certificates and certificate revocation lists and for the subject information access extension of certificates. AUTHORITY_INFO_ACCESS_free() frees aia. 🫶

---

💖 RETURN VALUES 💖

ACCESS_DESCRIPTION_new() and AUTHORITY_INFO_ACCESS_new() return the new ACCESS_DESCRIPTION or AUTHORITY_INFO_ACCESS object, respectively — or NULL if an error occurs. 😭 (the frees are just vibes, they don't return anything, they simply free.)

---

👑 SEE ALSO 👑

d2i_ACCESS_DESCRIPTION(3), DIST_POINT_new(3), GENERAL_NAME_new(3), OCSP_REQUEST_new(3), TS_REQ_new(3), X509_CRL_new(3), X509_EXTENSION_new(3), X509_new(3)

---

🧚 STANDARDS 🧚

heads up bestie: these extensions are only defined in the following RFC and not specified in the underlying X.509 standard. important detail, fr fr.

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile:

• section 4.2.2.1: Certificate Extensions: Authority Information Access
• section 4.2.2.2: Certificate Extensions: Subject Information Access
• section 5.2.7: CRL Extensions: Authority Information Access

regarding OCSP and TSP, see:

RFC 6960: X.509 Internet Public Key Infrastructure Online Certificate Status Protocol

RFC 3161: Internet X.509 Public Key Infrastructure Time-Stamp Protocol

---

🌈 HISTORY 🌈

ACCESS_DESCRIPTION_new(), ACCESS_DESCRIPTION_free(), AUTHORITY_INFO_ACCESS_new(), and AUTHORITY_INFO_ACCESS_free() first appeared in OpenSSL 0.9.5 and have been available since OpenBSD 2.7. iconic longevity behavior honestly 💀👑

---

and that's the page!! 🎀 this Debian build is dated June 8, 2025 — go forth and access your information, bestie, you got this 🍓💜