SSL_CTX_ADD1_CHAIN_CERT(3)

🌟 SSL_CTX_ADD1_CHAIN_CERT(3) 🌟

okay so bestie, this page is from the Library Functions Manual and it's literally called SSL_CTX_ADD1_CHAIN_CERT(3). it's giving extra chain certificate processing and honestly it's more fun than it sounds. 💅

✨ NAME ✨

SSL_CTX_set0_chain, SSL_CTX_set1_chain, SSL_CTX_add0_chain_cert, SSL_CTX_add1_chain_cert, SSL_CTX_get0_chain_certs, SSL_CTX_clear_chain_certs, SSL_set0_chain, SSL_set1_chain, SSL_add0_chain_cert, SSL_add1_chain_cert, SSL_get0_chain_certs, SSL_clear_chain_certs — extra chain certificate processing

💻 SYNOPSIS 💻

library “libssl” libcrypto #include <openssl/ssl.h>

int
SSL_CTX_set0_chain(SSL_CTX *ctx, STACK_OF(X509) *chain);

int
SSL_CTX_set1_chain(SSL_CTX *ctx, STACK_OF(X509) *chain);

int
SSL_CTX_add0_chain_cert(SSL_CTX *ctx, X509 *cert);

int
SSL_CTX_add1_chain_cert(SSL_CTX *ctx, X509 *cert);

int
SSL_CTX_get0_chain_certs(SSL_CTX *ctx, STACK_OF(X509) **chain);

int
SSL_CTX_clear_chain_certs(SSL_CTX *ctx);

int
SSL_set0_chain(SSL *ssl, STACK_OF(X509) *chain);

int
SSL_set1_chain(SSL *ssl, STACK_OF(X509) *chain);

int
SSL_add0_chain_cert(SSL *ssl, X509 *cert);

int
SSL_add1_chain_cert(SSL *ssl, X509 *cert);

int
SSL_get0_chain_certs(SSL *ssl, STACK_OF(X509) **chain);

int
SSL_clear_chain_certs(SSL *ssl);

🌸 DESCRIPTION 🌸

Okay so picture this: you've got a certificate chain, and these functions are here to manage the extra chain certs. Let's break it down, bestie.

• SSL_CTX_set0_chain() and SSL_CTX_set1_chain() set the certificate chain associated with the current certificate of ctx to chain. The chain is not supposed to include the current certificate itself. no cap.
• SSL_CTX_add0_chain_cert() and SSL_CTX_add1_chain_cert() append the single certificate cert to the chain associated with the current certificate of ctx. just one cert at a time, okay?
• SSL_CTX_get0_chain_certs() retrieves the chain associated with the current certificate of ctx. get it? got it? good.
• SSL_CTX_clear_chain_certs() clears the existing chain associated with the current certificate of ctx, if any. this is equivalent to calling SSL_CTX_set0_chain() with chain set to NULL. bye-bye chain 💀

Each of these functions operates on the current end entity (i.e. server or client) certificate. This is the last certificate loaded or selected on the corresponding ctx structure, for example using SSL_CTX_use_certificate(3).

SSL_set0_chain(), SSL_set1_chain(), SSL_add0_chain_cert(), SSL_add1_chain_cert(), SSL_get0_chain_certs(), and SSL_clear_chain_certs() are similar except that they operate on the ssl connection. same energy, different object. 💅

Now the 1 vs 0 of it all — this is important:

• The functions containing a 1 in their name increment the reference count of the supplied certificate or chain, so it must be freed at some point after the operation. you don't own it forever, bestie.
• Those containing a 0 do not increment reference counts and the supplied certificate or chain must not be freed after the operation. like, don't touch it. periodt.

The chains associated with an SSL_CTX structure are copied to the new SSL structure when SSL_new(3) is called. Existing SSL structures are not affected by any chains subsequently changed in the parent SSL_CTX. so if you change the parent later, the babies already born don't care. 🙈

One chain can be set for each key type supported by a server. So, for example, an RSA and an ECDSA certificate can have different chains. iconic, honestly. 🔥

If any certificates are added using these functions, no certificates added using SSL_CTX_add_extra_chain_cert(3) will be used. that's the rule. no mixing. 💀

🎀 RETURN VALUES 🎀

These functions return 1 for success or 0 for failure. that's it. that's the whole vibe check. 💖

🦋 SEE ALSO 🦋

• ssl(3)
• SSL_CTX_add_extra_chain_cert(3)
• SSL_CTX_use_certificate(3)

📜 HISTORY 📜

These functions first appeared in OpenSSL 1.0.2 and have been available since OpenBSD 6.5. so they're not new new, but they're iconic. 👑

---

💖 and that's the whole page, bestie! this beauty came from Debian, dated June 8, 2025, and the page is literally SSL_CTX_ADD1_CHAIN_CERT(3). slay. 💅