EXTENDED_KEY_USAGE_NEW(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💖 NAME 💖

EXTENDED_KEY_USAGE_new, EXTENDED_KEY_USAGE_free — X.509 key usage restrictions.

okay so this is the EXTENDED_KEY_USAGE_NEW(3) page from the Library Functions Manual, bestie, and we're about to make key usage restrictions make sense. no cap. 💅

✨ SYNOPSIS ✨

library “libcrypto” #include <openssl/x509v3.h>

EXTENDED_KEY_USAGE
EXTENDED_KEY_USAGE_new(void);

void
EXTENDED_KEY_USAGE_free(EXTENDED_KEY_USAGE *eku);

🦋 DESCRIPTION 🦋

So picture this: X509 end entity certificates can indicate that the key contained in them is only intended to be used for the specified purposes by using the key usage extension, the extended key usage extension, or both of them. And if both extensions are present? Then only uses compatible with both extensions are intended. periodt. ✨

EXTENDED_KEY_USAGE_new() allocates and initializes an empty EXTENDED_KEY_USAGE object. That object is a STACK_OF(ASN1_OBJECT), and it represents an ASN.1 ExtKeyUsageSyntax structure defined in RFC 5280 section 4.2.1.12. It can hold key purpose identifiers. iconic behavior, honestly. 🎀

EXTENDED_KEY_USAGE_free() frees eku. simple as that. 🫶

The key usage extension uses the ASN.1 BIT STRING data type and doesn't require any dedicated object. noted, bestie. 💜

🌸 RETURN VALUES 🌸

EXTENDED_KEY_USAGE_new() returns the new EXTENDED_KEY_USAGE object or NULL if an error occurs. that's the whole vibe check. 💀

🎀 SEE ALSO 🎀

🌈 STANDARDS 🌈

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile:

  • section 4.2.1.3: Key Usage
  • section 4.2.1.12: Extended Key Usage

👑 HISTORY 👑

EXTENDED_KEY_USAGE_new() and EXTENDED_KEY_USAGE_free() first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2. slay, old but still iconic. 🔥

xoxo, this cutie is from Debian, dated June 8, 2025, and it's literally EXTENDED_KEY_USAGE_NEW(3) — mwah 💋🌸

📦 where this page comes from