SSL_GET_PEER_CERT_CHAIN(3)

💅 SSL_GET_PEER_CERT_CHAIN(3) 💅

okay so bestie, this one's from the Library Functions Manual and it's literally all about peeking at the certificate chain your peer sent you. no cap, it's giving "i just want to see what you brought to the party" energy. let's get into it 🎀

---

✨ NAME ✨

SSL_get_peer_cert_chain — get the X509 certificate chain sent by the peer 🦋

---

🌸 SYNOPSIS 🌸

library “libssl” libcrypto
#include <openssl/ssl.h>

STACK_OF(X509) *
SSL_get_peer_cert_chain(const SSL *ssl);

like, that's the whole vibe right there 💖

---

💜 DESCRIPTION 💜

SSL_get_peer_cert_chain() hands you back a pointer to a STACK_OF(X509) of certificates — that's the certificate chain of the peer, periodt. 🔥

okay but here's where it gets spicy, so pay attention bestie:

• if you call it on the client side, the stack also contains the peer's certificate 👑
• if you call it on the server side, you gotta get the peer's certificate separately using SSL_get_peer_certificate(3) 🙈
• and if the peer didn't present a certificate at all? you get NULL. that's it. that's the whole thing. 💀

ngl, the important detail here is that SSL_get_peer_cert_chain() returns the peer chain as sent by the peer: it only consists of certificates the peer has sent (in the order the peer has sent them), and it is not a verified chain. like, it's literally just what they handed over, not a glow-up-approved version ✨

and listen — if the session is resumed, peers do not send certificates, so a NULL pointer is returned. 😭 applications can call SSL_session_reused() to determine whether a session is resumed. iykyk 🧚

🚨 huge heads up bestie: the reference count of the STACK_OF(X509) object is not incremented. if the corresponding session is freed, the pointer must not be used any longer. like, do NOT keep using it after the session dips, fr fr 💅

---

⭐ RETURN VALUES ⭐

the following return values can occur:

• NULL — no certificate was presented by the peer, or no connection was established, or the certificate chain is no longer available when a session is reused. 🙈
• Pointer to a STACK_OF(X509) — the return value points to the certificate chain presented by the peer. slay 👑

---

🌈 SEE ALSO 🌈

ssl(3), SSL_get_peer_certificate(3) 🫶

---

🎀 HISTORY 🎀

SSL_get_peer_cert_chain() first appeared in SSLeay 0.8.0 and has been available since OpenBSD 2.4. iconic behavior honestly, it's been serving since forever 👑

---

okay that's the whole page bestie, go forth and check those chains 💖✨🌸

Deiban, June 8, 2025 — mwah, love u, bye! 💅🦋