X509_NAME_PRINT_EX(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💖 NAME 💖

okay so welcome to X509_NAME_PRINT_EX(3), the libcrypto page for the X509_NAME printing routines: X509_NAME_print_ex, X509_NAME_print_ex_fp, and X509_NAME_oneline. bestie, this is your one-stop group chat for turning a name into readable output 💅✨

🌟 SYNOPSIS 🌟

the manual says library “libcrypto” and this include:

library “libcrypto”
#include <openssl/x509.h>

then the function signatures, exactly:

int
X509_NAME_print_ex(BIO *out, const X509_NAME *nm, int indent,
    unsigned long flags);

int
X509_NAME_print_ex_fp(FILE *fp, const X509_NAME *nm, int indent,
    unsigned long flags);

char *
X509_NAME_oneline(const X509_NAME *a, char *buf, int size);

🦋 DESCRIPTION 🦋

okay so first up: X509_NAME_print_ex() prints a human readable version of nm to the BIO out. each line (for multiline formats) is indented by indent spaces. and the output format can be extensively customised by use of the flags parameter — lowkey iconic customization energy 🎀

X509_NAME_print_ex_fp() is identical to X509_NAME_print_ex() except the output is written to the FILE pointer fp. same vibe, different destination 💖

X509_NAME_oneline() prints an ASCII version of a to buf. if buf is NULL, then a buffer is dynamically allocated and returned, and size is ignored. otherwise, at most size bytes will be written, including the ending NUL, and buf is returned. very “it handles it for you” of it ✨

🚨 not me reminding you that X509_NAME_oneline() is a legacy function which produces a non-standard output form. it doesn't handle multi-character fields and has various quirks and inconsistencies. its use is strongly discouraged in new applications. like… fr fr, don't build new stuff on it 💀

although there are a large number of possible flags, for most purposes XN_FLAG_ONELINE, XN_FLAG_MULTILINE, or XN_FLAG_RFC2253 will suffice. as noted on the ASN1_STRING_print_ex(3) manual page, for UTF-8 terminals the ASN1_STRFLGS_ESC_MSB should be unset: so for example XN_FLAG_ONELINE & ~ASN1_STRFLGS_ESC_MSB would be used. no cap, that little & ~ combo is giving practical main character energy 🌈

the complete set of the flags supported by X509_NAME_print_ex is listed below. several options can be OR'ed together 🫶

🎀 separator flags 🎀

the options XN_FLAG_SEP_COMMA_PLUS, XN_FLAG_SEP_CPLUS_SPC, XN_FLAG_SEP_SPLUS_SPC, and XN_FLAG_SEP_MULTILINE determine the field separators to use. two distinct separators are used between distinct RelativeDistinguishedName components and separate values in the same RDN for a multi-valued RDN. multi-valued RDNs are currently very rare so the second separator will hardly ever be used — a rare cameo, honestly 💅

  • XN_FLAG_SEP_COMMA_PLUS — uses comma and plus as separators.
  • XN_FLAG_SEP_CPLUS_SPC — uses comma and plus with spaces: this is more readable than plain comma and plus.
  • XN_FLAG_SEP_SPLUS_SPC — uses spaced semicolon and plus.
  • XN_FLAG_SEP_MULTILINE — uses spaced newline and plus respectively.
  • XN_FLAG_SEP_MASK — contains the bits used to represent these four options.

🌸 field-name flags 🌸

if XN_FLAG_DN_REV is set, the whole DN is printed in reversed order. plot twist, but make it distinguished name 🔥

the fields XN_FLAG_FN_SN, XN_FLAG_FN_LN, XN_FLAG_FN_OID, and XN_FLAG_FN_NONE determine how a field name is displayed. it will use the short name (e.g. CN), the long name (e.g. commonName), always use OID numerical form (normally OIDs are only used if the field name is not recognised) and no field name, respectively. XN_FLAG_FN_MASK contains the bits used to represent these four options 🧚

  • XN_FLAG_FN_SN — use the short name, e.g. CN.
  • XN_FLAG_FN_LN — use the long name, e.g. commonName.
  • XN_FLAG_FN_OID — always use OID numerical form (normally OIDs are only used if the field name is not recognised).
  • XN_FLAG_FN_NONE — no field name.
  • XN_FLAG_FN_MASK — contains the bits used to represent these four options.

✨ other flags ✨

  • XN_FLAG_SPC_EQ — if set, spaces will be placed around the = character separating field names and values.
  • XN_FLAG_DUMP_UNKNOWN_FIELDS — if set, the encoding of unknown fields is printed instead of the values.
  • XN_FLAG_FN_ALIGN — if set, field names are padded to 20 characters: this is only of use for multiline format.

additionally, all the options supported by ASN1_STRING_print_ex(3) can be used to control how each field value is displayed. obsessed with layered customization, honestly 💜

👑 preset format flags 👑

in addition a number of options can be set for commonly used formats. these are the presets, and they ate:

  • XN_FLAG_RFC2253 — sets options which produce an output compatible with RFC 2253. it is equivalent to ASN1_STRFLGS_RFC2253 | XN_FLAG_SEP_COMMA_PLUS | XN_FLAG_DN_REV | XN_FLAG_FN_SN | XN_FLAG_DUMP_UNKNOWN_FIELDS.
  • XN_FLAG_ONELINE — a more readable one line format which is the same as: ASN1_STRFLGS_RFC2253 | ASN1_STRFLGS_ESC_QUOTE | XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_SPC_EQ | XN_FLAG_FN_SN.
  • XN_FLAG_MULTILINE — a multiline format which is the same as: ASN1_STRFLGS_ESC_CTRL | ASN1_STRFLGS_ESC_MSB | XN_FLAG_SEP_MULTILINE | XN_FLAG_SPC_EQ | XN_FLAG_FN_LN | XN_FLAG_FN_ALIGN.
  • XN_FLAG_COMPAT — uses the traditional non-standard SSLeay format.

💀 RETURN VALUES 💀

okay so the return-value vibe check:

  • X509_NAME_print_ex() and X509_NAME_print_ex_fp() return 1 on success or 0 on error if XN_FLAG_COMPAT is set in flags. otherwise, they return the number of printed bytes including the indentation or -1 on error.
  • X509_NAME_oneline() returns a valid string on success or NULL on error.

🌈 SEE ALSO 🌈

🎀 HISTORY 🎀

  • X509_NAME_oneline() first appeared in SSLeay 0.5.1 and has been available since OpenBSD 2.4.
  • X509_NAME_print_ex() and X509_NAME_print_ex_fp() first appeared in OpenSSL 0.9.6 and have been available since OpenBSD 2.9.

💖 that's the whole page, bestie: source/version Debian, date June 8, 2025, title X509_NAME_PRINT_EX(3) — byeee 🎀

📦 where this page comes from