X509_NAME_HASH(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

✨ X509_NAME_HASH ✨

okay so bestie, we're in the libcrypto cinematic universe today and this page is all about turning an X.501 Name into a little hash number 💅 hi bestie, welcome to the X509_NAME_HASH(3) page, this is the group chat

🌸 SYNOPSIS 🌸

library “libcrypto” #include <openssl/x509.h>

unsigned long
X509_NAME_hash(X509_NAME *name);

unsigned long
X509_issuer_name_hash(X509 *x);

unsigned long
X509_subject_name_hash(X509 *x);

unsigned long
X509_NAME_hash_old(X509_NAME *name);

unsigned long
X509_issuer_name_hash_old(X509 *x);

unsigned long
X509_subject_name_hash_old(X509 *x);

🎀 DESCRIPTION 🎀

So like, six whole functions, all of them returning an unsigned long, all of them hashing a name. Let's break it down fr fr 👑

  • X509_NAME_hash() — calculates an SHA1(3) hash of the DER-encoded form of name. it's giving "used by X509_LOOKUP_hash_dir(3) to locate certificate files in the file system" — that's literally its whole job bestie 🗂️✨
  • X509_issuer_name_hash() — wrapper that calculates, like, this same hash but for the issuer name of x. same energy, different name 💖
  • X509_subject_name_hash() — another wrapper, this one for the subject name of x. twin behavior, no cap 🫶
  • X509_NAME_hash_old(), X509_issuer_name_hash_old(), and X509_subject_name_hash_old() — the variants that use MD5 instead of SHA-1. yes, MD5. the old one. that's the whole vibe of the _old suffix 🌈
not me emphasizing that X509_NAME_hash() hashes the DER-encoded form — that detail is load-bearing, don't skip it 💀

⭐ RETURN VALUES ⭐

these functions return the hash value, or 0 if an error occurs. so if you get a 0... that's not a cute hash bestie, that's a problem 😭

🦋 SEE ALSO 🦋

go read those, iykyk 📚💜

👑 HISTORY 👑

okay the lore is actually kind of iconic so sit down 🍓

  • X509_subject_name_hash() first appeared in SSLeay 0.4.0, X509_issuer_name_hash() in SSLeay 0.5.1, and X509_NAME_hash() in SSLeay 0.8.0.
  • they were switched to hashing the DER representation of the name rather than an ASCII rendering in SSLeay 0.9.0 — character development fr 💅
  • they've all been available since OpenBSD 2.4.
  • they were switched to using SHA-1 instead of MD5 in OpenSSL 1.0.0 and in OpenBSD 4.9.
  • X509_NAME_hash_old(), X509_issuer_name_hash_old(), and X509_subject_name_hash_old() first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9.

and that's the page!! 🎀 this little writeup came from the Debian folks and it's dated June 8, 2025 — mwah, thank you for the lore drop, we ate 🫶✨💖

📦 where this page comes from