X509_ATTRIBUTE_NEW(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

🎀 X509_ATTRIBUTE_NEW(3) 🎀

hii bestie 💖 so this is a page from the Library Functions Manual, and it's all about the generic X.501 Attribute — like, the ASN.1 version, not the vibe you're thinking of. it's giving "very foundational, very abstract, slightly unhinged" and honestly? we're gonna get through it together. buckle up 🦋

✨ NAME ✨

X509_ATTRIBUTE_new, X509_ATTRIBUTE_create, X509_ATTRIBUTE_dup, X509_ATTRIBUTE_free — generic X.501 Attribute 💅

okay so, four functions, one data type, let's GO 🚀

🌸 SYNOPSIS 🌸

library “libcrypto”
#include <openssl/x509.h>

X509_ATTRIBUTE *
X509_ATTRIBUTE_new(void);

X509_ATTRIBUTE *
X509_ATTRIBUTE_create(int nid, int type, void *value);

X509_ATTRIBUTE *
X509_ATTRIBUTE_dup(X509_ATTRIBUTE *attr);

void
X509_ATTRIBUTE_free(X509_ATTRIBUTE *attr);

no cap, that's the whole cast of characters right there 💜

🦋 DESCRIPTION 🦋

so in the X.501 standard, an Attribute is the fundamental ASN.1 data type used to represent, like, any kind of property of any kind of directory entry. yes ma'am, it's the "one size fits all" of ASN.1 and it is absolutely main character energy ✨

now here's the tea 🍓 — in OpenSSL, very few objects actually use it directly. the big three that do:

like, ikykyk, it's a whole little squad 🫶

the four functions, one by one

  • X509_ATTRIBUTE_new() — allocates and initializes an empty X509_ATTRIBUTE object. that's it, that's the whole thing. a fresh blank slate, a clean girlie with nothing in her set of values yet 🌈
  • X509_ATTRIBUTE_create() — allocates a shiny new multi-valued X509_ATTRIBUTE object of type nid, and initializes its set of values to contain one new ASN.1 ANY object with the given value and type. ✨ the type usually is one of the V_ASN1_* constants defined in <openssl/asn1.h>; it is stored without validating it (yes, really, no vibe check at all 💀). if the function succeeds, ownership of the value is transferred to the new X509_ATTRIBUTE object — so don't go freeing it yourself afterwards, that's a whole mess 🪦
⚠️ bestie pls be careful to not confuse the type of the attribute and the type of the value. they are two different things and mixing them up is a classic own-goal 😭
  • X509_ATTRIBUTE_dup() — creates a deep copy of attr. deep. copy. not a little hand-holdy shallow one, a real one 💅
  • X509_ATTRIBUTE_free() — frees attr. bye bestie 👋

💖 RETURN VALUES 💖

  • X509_ATTRIBUTE_new(), X509_ATTRIBUTE_create(), and X509_ATTRIBUTE_dup() return the new X509_ATTRIBUTE object, or NULL if an error occurs.

in particular, these functions fail if memory allocation fails (rude of the allocator honestly 🙄). X509_ATTRIBUTE_create() also fails if OBJ_nid2obj(3) fails on nid.

🔥 SEE ALSO 🔥

the whole extended friend group, no gatekeeping 🫶

👑 STANDARDS 👑

the receipts, as promised 🧾

for the general definition of the Attribute data type:

ITU-T Recommendation X.501, also known as ISO/IEC 9594-2: Information Technology – Open Systems Interconnection – The Directory: Models, section 8.2: Overall structure

for the specific definition in the context of certification requests:

RFC 2986: PKCS #10: Certification Request Syntax Specification, section 4.1: CertificationRequestInfo

for the specific use in the context of private key information:

RFC 5208: Public-Key Cryptography Standards (PKCS) #8: Private-Key Information Syntax Specification

for the specific definition in the context of PFX:

RFC 7292: PKCS #12: Personal Information Exchange Syntax, section 4.2: The SafeBag Type

slay, citations complete ⭐

🌺 HISTORY 🌺

a lil throwback moment 🕰️

  • X509_ATTRIBUTE_new() and X509_ATTRIBUTE_free() first appeared in SSLeay 0.5.1 and have been available since OpenBSD 2.4.
  • X509_ATTRIBUTE_create() and X509_ATTRIBUTE_dup() first appeared in SSLeay 0.9.1 and have been available since OpenBSD 2.6.

elder emojis only for these two, they've been here a WHILE 🧚

💀 BUGS 💀

okay this section is fully just the manpage author having a moment and honestly? valid. 😭

  • A data type designed to hold arbitrary data is an oxymoron.
  • While it may occasionally be useful for abstract syntax specification or for generic container objects, using it for the representation of specific data in a specific data structure feels like dubious design.
  • Having two distinct data types to hold arbitrary data — in this case, X509_ATTRIBUTE on the X.501 language level and X509_EXTENSION as described in X509_EXTENSION_new(3) on the X.509 language level — feels even more questionable, in particular considering that Attributes in certification requests can be used to ask for Extensions in certificates.
  • At the very least, the direct use of the low-level generic X509_ATTRIBUTE type in specific data types like certification requests or private key information looks like a layering violation and appears to put type safety into jeopardy.

ngl the last two paragraphs are a read 👀 and the author ate, no crumbs.

and that's the page bestie!! 🎀 this one's from the Debian build, dated June 8, 2025, and it lives under the name X509_ATTRIBUTE_NEW(3) in your manpages 💖 go forth and don't confuse your attribute type with your value type, mwah 🫶✨

📦 where this page comes from