LIBRESSL-SSL_GET_PEER_CERTIFICATE(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💅 SSL_GET_PEER_CERTIFICATE(3) 💅

ok so bestie, we're in the Library Functions Manual for libssl today and this one's a lil function that hands you the peer's certificate. it's giving "who are you and can I see your ID" energy 🪪✨

🌸 NAME 🌸

SSL_get_peer_certificate — get the X509 certificate of the peer 💖

✨ SYNOPSIS ✨

library “libssl” libcrypto

#include <openssl/ssl.h>

X509 *
SSL_get_peer_certificate(const SSL *ssl);

that's it. one arg, one return. we love a low-maintenance icon 🎀

🦋 DESCRIPTION 🦋

okay so SSL_get_peer_certificate() returns a pointer to the X509 certificate the peer presented. that's the whole vibe. and if the peer did not present a certificate? you get NULL back, bestie. empty hands. no cert. 😭

now here's the lore — due to the protocol definition, a TLS/SSL server will always send a certificate, if present. periodt. a client though? a client will only send a certificate when it's explicitly requested to do so by the server (peep SSL_CTX_set_verify(3) for that one 👀). and if an anonymous cipher is being used, no certificates are sent at all. zero. nada. 🫥

⚠️ huge one, don't skip: that a certificate is returned does not indicate anything about the verification state. like, at all. it's just "here's a cert", not "here's a cert I trust". use SSL_get_verify_result(3) to actually check the verification state. ngl this trips people up constantly 💀

and the reference count tea ☕ — the reference count of the X509 object is incremented by one, so that it will not be destroyed when the session containing the peer certificate is freed. main character survival energy fr fr. but that means the X509 object must be explicitly freed using X509_free(3). it does not clean up after itself, bestie. you gotta do it. 🙈

🎀 RETURN VALUES 🎀

the following return values can occur:

  • NULL — no certificate was presented by the peer, or no connection was established. sad girl hours 🥲
  • Pointer to an X509 certificate — the return value points to the certificate presented by the peer. slay 💅👑

🔥 SEE ALSO 🔥

go read those, iykyk 📚✨

🌈 HISTORY 🌈

SSL_get_peer_certificate() appeared in SSLeay 0.4 or earlier and has been available since OpenBSD 2.4. ancient. iconic. still here. 👑

that's the whole page bestie, go free your X509 objects and verify your peers 💜

mwah 💋 — this lil rewrite came to you from the Debian build, dated June 8, 2025, and it's the SSL_GET_PEER_CERTIFICATE(3) page. 🎀🦋✨

📦 where this page comes from