ASN1_STRING_PRINT_EX(3)

💖 ASN1_STRING_PRINT_EX(3) 💖

okay so bestie, welcome to the Library Functions Manual era — this whole page is about the ASN1_STRING output routines, and honestly it's giving “niche but iconic.” We're gonna print, escape, dump, and vibe-check ASN.1 strings. No cap. 💅

🌸 NAME 🌸

ASN1_STRING_print_ex, ASN1_STRING_print_ex_fp, ASN1_STRING_print, and ASN1_tag2str — the ASN1_STRING output routines. periodt.

✨ SYNOPSIS ✨

You're in libcrypto land, and you pull in <openssl/asn1.h>. The whole lineup is literally:

library “libcrypto”
#include <openssl/asn1.h>

int
ASN1_STRING_print_ex(BIO *out, const ASN1_STRING *str,
    unsigned long flags);

int
ASN1_STRING_print_ex_fp(FILE *fp, const ASN1_STRING *str,
    unsigned long flags);

int
ASN1_STRING_print(BIO *out, const ASN1_STRING *str);

const char *
ASN1_tag2str(int tag);

📖 DESCRIPTION 📖

These functions output an ASN1_STRING structure. And bestie, ASN1_STRING is used to represent all the ASN.1 string types. So yeah, main-character energy for string types. 🫶

• ASN1_STRING_print_ex() — outputs str to out, with the format being determined by the options in flags. Very choose-your-own-adventure.
• ASN1_STRING_print_ex_fp() — identical, except it outputs to fp instead. Same vibe, different destination.
• ASN1_STRING_print() — prints str to out but uses a different format than ASN1_STRING_print_ex(). It replaces unprintable characters (other than CR, LF) with ..
• ASN1_tag2str() — returns a human-readable name of the specified ASN.1 tag. Slay, labels.

warning bestie: ASN1_STRING_print() is a deprecated function which should be avoided; use ASN1_STRING_print_ex() instead. Not me using the deprecated one… don't do it. 😭

Although there are a large number of options, ASN1_STRFLGS_RFC2253 is often suitable, or on UTF-8 terminals ASN1_STRFLGS_RFC2253 and ~ASN1_STRFLGS_ESC_MSB. That's the lowkey recommendation, fr fr.

The complete set of supported options for flags is listed below. Buckle up, because the flag lore is deep. 🎀

• ASN1_STRFLGS_ESC_2253 — if set, the characters determined by RFC 2253 are escaped.
• ASN1_STRFLGS_ESC_CTRL — if set, control characters are escaped.
• ASN1_STRFLGS_ESC_MSB — if set, characters with the MSB set are escaped. This option should not be used if the terminal correctly interprets UTF-8 sequences.
• ASN1_STRFLGS_ESC_QUOTE — if set, the whole string is surrounded by double quote characters instead of using backslash notation. This is arguably more readable. ✨
• ASN1_STRFLGS_UTF8_CONVERT — if set, characters are converted to UTF-8 format first. If the terminal supports the display of UTF-8 sequences, then this option will correctly display multi-byte characters.
• ASN1_STRFLGS_IGNORE_TYPE — if set, the string type is not interpreted at all: everything is assumed to be one byte per character. This is primarily for debugging purposes and can result in confusing output in multi-character strings. 🙈
• ASN1_STRFLGS_SHOW_TYPE — if set, the string type itself is printed before its value (for example "BMPSTRING"), using ASN1_tag2str().
• ASN1_STRFLGS_DUMP_ALL — if set, any type is dumped.
• ASN1_STRFLGS_DUMP_UNKNOWN — normally non-character string types (such as OCTET STRING) are assumed to be one byte per character; if set, then they will be dumped instead.
• ASN1_STRFLGS_DUMP_DER — when a type is dumped, normally just the content octets are printed; if set, then the complete encoding is dumped instead (including tag and length octets).
• ASN1_STRFLGS_RFC2253 — includes all the flags required by RFC 2253. It is equivalent to:

ASN1_STRFLGS_ESC_2253 | ASN1_STRFLGS_ESC_CTRL |
ASN1_STRFLGS_ESC_MSB | ASN1_STRFLGS_UTF8_CONVERT |
ASN1_STRFLGS_DUMP_UNKNOWN | ASN1_STRFLGS_DUMP_DER

Now for the escaping tea ☕: escaping takes several forms. If the character being escaped is a 16-bit character, then the form "\UXXXX" is used using exactly four characters for the hex representation. If it is 32 bits, then "\WXXXXXXXX" is used using eight characters of its hex representation. These forms will only be used if UTF-8 conversion is not set (see above).

Printable characters are normally escaped using the backslash (\) character. If ASN1_STRFLGS_ESC_QUOTE is set, then the whole string is instead surrounded by double quote characters: this is arguably more readable than the backslash notation. Other characters use "\XX" using exactly two characters of the hex representation. iykyk.

If ASN1_STRFLGS_UTF8_CONVERT is set, then characters are converted to UTF-8 format first. If the terminal supports the display of UTF-8 sequences, then this option will correctly display multi-byte characters. 🦋

If ASN1_STRFLGS_IGNORE_TYPE is set, then the string type is not interpreted at all: everything is assumed to be one byte per character. This is primarily for debugging purposes and can result in confusing output in multi-character strings.

If ASN1_STRFLGS_SHOW_TYPE is set, then the string type itself is printed before its value (for example "BMPSTRING"), using ASN1_tag2str().

Instead of being interpreted, the contents of a string can be “dumped”: this just outputs the value of the string using the form #XXXX using hex format for each octet. It's giving raw hex realness. 💀

If ASN1_STRFLGS_DUMP_ALL is set, then any type is dumped.

Normally non-character string types (such as OCTET STRING) are assumed to be one byte per character; if ASN1_STRFLGS_DUMP_UNKNOWN is set, then they will be dumped instead.

When a type is dumped, normally just the content octets are printed; if ASN1_STRFLGS_DUMP_DER is set, then the complete encoding is dumped instead (including tag and length octets).

ASN1_STRFLGS_RFC2253 includes all the flags required by RFC 2253. It is equivalent to ASN1_STRFLGS_ESC_2253 | ASN1_STRFLGS_ESC_CTRL | ASN1_STRFLGS_ESC_MSB | ASN1_STRFLGS_UTF8_CONVERT | ASN1_STRFLGS_DUMP_UNKNOWN | ASN1_STRFLGS_DUMP_DER.

🫶 RETURN VALUES 🫶

• ASN1_STRING_print_ex() and ASN1_STRING_print_ex_fp() — return the number of characters written, or -1 if an error occurred.
• ASN1_STRING_print() — returns 1 on success or 0 on error.
• ASN1_tag2str() — returns a static string.

👑 SEE ALSO 👑

ASN1_parse_dump(3), ASN1_STRING_new(3), X509_NAME_print_ex(3), X509_signature_dump(3) — go read these too, bestie. The lore continues. 🌈

🧚 HISTORY 🧚

• ASN1_STRING_print() first appeared in SSLeay 0.6.5 and has been available since OpenBSD 2.4.
• ASN1_tag2str() first appeared in OpenSSL 0.9.5 and has been available since OpenBSD 2.7.
• ASN1_STRING_print_ex() and ASN1_STRING_print_ex_fp() first appeared in OpenSSL 0.9.6 and have been available since OpenBSD 2.9.

---

okay that's the whole page, bestie — iconic behavior from the ASN.1 string output girlies. This one is from Debian, dated June 8, 2025. xoxo, manual page 💅✨