X509V3_EXT_GET_NID(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💅 X509V3_EXT_GET_NID(3) — bestie, let’s retrieve those extension methods

Okay so this is the X509V3_EXT_GET_NID(3) page from the Library Functions Manual, and it’s here to explain how we retrieve X.509v3 certificate extension methods. It’s giving “lookup by number or by actual extension” energy, and honestly? Kinda iconic. 🎀

✨ NAME ✨

  • X509V3_EXT_get_nid, X509V3_EXT_get — retrieve X.509v3 certificate extension methods.

🌸 SYNOPSIS 🌸

library “libcrypto”
#include <openssl/x509v3.h>

const X509V3_EXT_METHOD *
X509V3_EXT_get_nid(int nid);

const X509V3_EXT_METHOD *
X509V3_EXT_get(X509_EXTENSION *ext);

🦋 DESCRIPTION 🦋

Okay so picture an X.509v3 certificate extension. It contains an Object Identifier (OID), a boolean criticality indicator, and an opaque extension value — an ASN1_OCTET_STRING — whose meaning is determined by the OID. That’s the whole trio, bestie. 💖

The library’s X509V3_EXT_METHOD type, which is not yet documented in detail, contains a numeric identifier (NID) to represent the OID and various handlers for encoding, decoding, printing, and configuring the extension’s value. Criticality is handled separately, for example as an argument to X509V3_add1_i2d(3). Periodt. ✨

🎀 RETURN VALUES 🎀

  • X509V3_EXT_get_nid() returns the X509V3_EXT_METHOD corresponding to the numeric identifier nid, or NULL if there is none.
  • X509V3_EXT_get() returns the X509V3_EXT_METHOD associated with the extension type of ext, or NULL if there is none.

No match? You get NULL, bestie. It’s not ghosting you on purpose. 💀

👀 SEE ALSO 👀

🌈 STANDARDS 🌈

  • RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
    • section 4.2: Certificate Extensions

⏳ HISTORY ⏳

These functions first appeared in OpenSSL 0.9.2b and have been available since OpenBSD 2.6. Vintage behavior, but make it useful. 👑

💀 CAVEATS 💀

Okay bestie, important stuff — don’t skip this part:

In LibreSSL, these functions only support built-in nid values corresponding to static built-in objects. Other implementations have incomplete support for custom extension methods, whose API is not threadsafe, does not affect the behavior of X509_verify_cert(3), and has various other surprising quirks. Both functions prefer built-in methods over custom methods with the same OID. 🫶

This page came from Debian, dated June 8, 2025 — mwah 💋

📦 where this page comes from