LIBRESSL-X509_NAME_ADD_ENTRY_BY_TXT(3)

✨ X509_NAME_ADD_ENTRY_BY_T(3) ✨

okay so bestie, this is the LibreSSL page for X509_NAME_ADD_ENTRY_BY_T(3) and honestly? it's giving "let me rearrange the ✨name✨ on your X509 thing" energy 💅 stay with me, it's actually so good.

---

💖 NAME 💖

X509_NAME_add_entry_by_txt, X509_NAME_add_entry_by_OBJ, X509_NAME_add_entry_by_NID, X509_NAME_add_entry, X509_NAME_delete_entry — the X509_NAME modification functions, aka the glow-up crew for your name structure 🫶

---

🎀 SYNOPSIS 🎀

like, first of all, you need library “libcrypto” and you gotta pull in the header:

#include <openssl/x509.h>

then the whole squad rolls up:

int
X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
    const unsigned char *bytes, int len, int loc, int set);

int
X509_NAME_add_entry_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj,
    int type, const unsigned char *bytes, int len, int loc, int set);

int
X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
    const unsigned char *bytes, int len, int loc, int set);

int
X509_NAME_add_entry(X509_NAME *name, const X509_NAME_ENTRY *ne, int loc,
    int set);

X509_NAME_ENTRY *
X509_NAME_delete_entry(X509_NAME *name, int loc);

no cap, that's the whole lineup 🔥

---

🦋 DESCRIPTION 🦋

so <pink>X509_NAME_add_entry_by_txt()</pink>, <pink>X509_NAME_add_entry_by_OBJ()</pink>, and <pink>X509_NAME_add_entry_by_NID()</pink> are the three siblings that add a field — and the only difference is how you name it: by a string field, by an object obj, or by a NID nid, respectively 💫 The field value you're adding lives in bytes, and its length is len. and if len is -1? the field length just gets calculated internally using strlen(bytes) — it does the math for you, icon behavior tbh 🧮✨

the type of the field is decided by type, which can either be a definition of the type of bytes (like MBSTRING_ASC) or a standard ASN.1 type (like V_ASN1_IA5STRING). The new entry gets added to a position determined by loc and set 📍

X509_NAME_add_entry() adds a copy of an X509_NAME_ENTRY structure ne to name, at the position determined by loc and set. and because it's adding a copy of ne, you still gotta free ne yourself after the call — yes bestie, both of them, no short cuts 🙈

X509_NAME_delete_entry() deletes an entry from name at position loc. The deleted entry is returned and must be freed up. so like, take it, love it, then free it 💀

important: the use of string types such as MBSTRING_ASC or MBSTRING_UTF8 is strongly recommended for the type parameter. This lets the internal code correctly determine the type of the field and apply length checks according to the relevant standards. it's literally the responsible thing to do 🎀

but if you instead use an ASN.1 type, no checks are performed and the supplied data in bytes is used directly. zero vibe check, zero guardrails, straight through 🚨

in X509_NAME_add_entry_by_txt() the field string represents the field name using OBJ_txt2obj(field, 0) ⭐

now, the loc and set parameters decide where a new entry goes. For almost all applications, loc can be set to -1 and set to 0. This adds a new entry to the end of name as a single valued RelativeDistinguishedName (RDN). like, that's the default path, that's the one you want 99% of the time 👑

loc actually determines the index where the new entry is inserted: if it is -1 it is appended.

set determines how the new type is added. If it is zero, a new RDN is created. 🆕

If set is -1 or 1, it is added to the previous or next RDN structure respectively. This makes it a multivalued RDN — and since multivalue RDNs are very seldom used, set is almost always set to zero. like, almost always. fr fr 🌸

---

🌈 RETURN VALUES 🌈

X509_NAME_add_entry_by_txt(), X509_NAME_add_entry_by_OBJ(), X509_NAME_add_entry_by_NID(), and X509_NAME_add_entry() return 1 for success or 0 if an error occurred. classic 1-or-0 situation 💫

X509_NAME_delete_entry() returns either the deleted X509_NAME_ENTRY structure or NULL if an error occurred.

and in some cases of failure, the reason can be determined with ERR_get_error(3) — your little detective moment 🔍🕵️

---

🌸 EXAMPLES 🌸

let's create an X509_NAME structure, because why not:

C=UK, O=Disorganized Organization, CN=Joe Bloggs

X509_NAME *nm;
nm = X509_NAME_new();
if (nm == NULL)
        /* Some error */
if (!X509_NAME_add_entry_by_txt(nm, "C", MBSTRING_ASC,
                "UK", -1, -1, 0))
        /* Error */
if (!X509_NAME_add_entry_by_txt(nm, "O", MBSTRING_ASC,
                "Disorganized Organization", -1, -1, 0))
        /* Error */
if (!X509_NAME_add_entry_by_txt(nm, "CN", MBSTRING_ASC,
                "Joe Bloggs", -1, -1, 0))
        /* Error */

look at that. iconic. ate and left no crumbs 👑✨

---

🧚 SEE ALSO 🧚

d2i_X509_NAME(3), X509_NAME_ENTRY_get_object(3), X509_NAME_get_index_by_NID(3), X509_NAME_new(3)

the whole friend group, go say hi 🫶

---

💜 HISTORY 💜

X509_NAME_add_entry() and X509_NAME_delete_entry() first appeared in SSLeay 0.8.0 and have been available since OpenBSD 2.4. 🦕

X509_NAME_add_entry_by_txt(), X509_NAME_add_entry_by_OBJ(), and X509_NAME_add_entry_by_NID() first appeared in OpenSSL 0.9.5 and have been available since OpenBSD 2.7. ⭐

---

and that's the page bestie 💅 mwah 💖

sign-off szn: this little beauty came from Debian, dated December 21, 2025, and it's filed under X509_NAME_ADD_ENTRY_BY_TXT(3) 🎀🦋🌸 ngl, slay.