NAME_CONSTRAINTS_NEW(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💅 NAME_CONSTRAINTS_NEW(3) — your girl's guide to the X.509 CA name constraints extension 🎀

okay so this is page 3 of the Library Functions Manual, and it lives in libcrypto (the OpenSSL crypto library), so bestie, you're in the right place if you're messing with certs ✨

✨ NAME ✨

NAME_CONSTRAINTS_new, NAME_CONSTRAINTS_free, GENERAL_SUBTREE_new, GENERAL_SUBTREE_free — it's giving X.509 CA name constraints extension energy, and honestly? iconic 🫶

🌸 SYNOPSIS 🌸

library “libcrypto” #include <openssl/x509v3.h>
NAME_CONSTRAINTS *
NAME_CONSTRAINTS_new(void);

void
NAME_CONSTRAINTS_free(NAME_CONSTRAINTS *names);

GENERAL_SUBTREE *
GENERAL_SUBTREE_new(void);

void
GENERAL_SUBTREE_free(GENERAL_SUBTREE *name);

🦋 DESCRIPTION 🦋

so X.509 CA certificates can use the name constraints extension to restrict the subject names of subsequent certificates in a certification path. like, gatekeeping but make it PKI 💀

NAME_CONSTRAINTS_new() allocates and initializes an empty NAME_CONSTRAINTS object, representing an ASN.1 NameConstraints structure defined in RFC 5280 section 4.2.1.10. and what even is that inside? literally two STACK_OF(GENERAL_SUBTREE) objects — one specifying permitted names, the other excluded names. one stack says "yes bestie come in," the other says "not you 🙈." and NAME_CONSTRAINTS_free() frees names. periodt 💅

GENERAL_SUBTREE_new() allocates and initializes an empty GENERAL_SUBTREE object, representing an ASN.1 GeneralSubtree structure defined in RFC 5280 section 4.2.1.10. it's a trivial wrapper around the GENERAL_NAME object documented in GENERAL_NAME_new(3) — lowkey just a little bestie holding a GENERAL_NAME's hand 🥺 and heads up: the standard requires the other fields of GENERAL_SUBTREE to be ignored. not me telling you to ignore them, the standard is, I'm just the messenger 🧚 and GENERAL_SUBTREE_free() frees name.

👑 RETURN VALUES 👑

NAME_CONSTRAINTS_new() and GENERAL_SUBTREE_new() return the new NAME_CONSTRAINTS or GENERAL_SUBTREE object, respectively, or NULL if an error occurs. so like, check for NULL, always, no cap 😭

🔥 SEE ALSO 🔥

go read your siblings, iykyk 📚

🌈 STANDARDS 🌈

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, section 4.2.1.10: Name Constraints — yes, the whole title, we're being thorough 💜

⭐ HISTORY ⭐

NAME_CONSTRAINTS_new(), NAME_CONSTRAINTS_free(), GENERAL_SUBTREE_new(), and GENERAL_SUBTREE_free() first appeared in OpenSSL 0.9.8 and have been available since OpenBSD 4.5. vintage, but in a cute way 🎀

k that's the whole vibe check — this page brought to you by the Debian crew, dated June 8, 2025, and yes it's still NAME_CONSTRAINTS_NEW(3) at the bottom too, we love a consistent footer 💖 slay, go constrain some names, ily 🫶✨

📦 where this page comes from