X509_OBJECT_GET0_X509(3)

💅 X509_OBJECT_GET0_X509(3) — like, the whole vibe

okay so bestie, welcome to the libcrypto corner of the Library Functions Manual 🎀 this one's all about the little wrapper struct that holds your certs, CRLs, private keys and strings for certificate stores. it's giving "backstage pass to the X509 store" energy, iykyk ✨

---

🌸 NAME 🌸

X509_OBJECT_get_type, X509_OBJECT_new, X509_OBJECT_free, X509_OBJECT_get0_X509, X509_OBJECT_get0_X509_CRL, X509_OBJECT_idx_by_subject, X509_OBJECT_retrieve_by_subject, X509_OBJECT_retrieve_match — the certificate, CRL, private key, and string wrapper for certificate stores. literally the little container that holds your stuff 🫶

---

✨ SYNOPSIS ✨

library “libcrypto” #include <openssl/x509_vfy.h>

X509_LOOKUP_TYPE
X509_OBJECT_get_type(const X509_OBJECT *obj);

X509_OBJECT *
X509_OBJECT_new(void);

void
X509_OBJECT_free(X509_OBJECT *obj);

X509 *
X509_OBJECT_get0_X509(const X509_OBJECT *obj);

X509_CRL *
X509_OBJECT_get0_X509_CRL(X509_OBJECT *obj);

int
X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *stack,
    X509_LOOKUP_TYPE type, X509_NAME *name);

X509_OBJECT *
X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *stack,
    X509_LOOKUP_TYPE type, X509_NAME *name);

X509_OBJECT *
X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *stack,
    X509_OBJECT *obj);

---

🦋 DESCRIPTION 🦋

so the X509_OBJECT structure is, like, a shallow wrapper around exactly one X509 certificate object or one X509_CRL certificate revocation list object. that's it, that's the whole thing 💀 and if you ever wanna know which one you're holding at any given moment, just check it with X509_OBJECT_get_type() — vibe check, but for structs ✨

every single X509_STORE object uses one stack of X509_OBJECT structures as its main storage area. slay, main character energy for real 👑

X509_OBJECT_new() allocates a brand-new X509_OBJECT structure. it sets the object type to X509_LU_NONE and the pointer to the certificate or CRL to NULL. fresh out the box, empty, no notes 🎀

okay so here's the tea on X509_OBJECT_free() ☕ if obj contains an X509 certificate, it calls X509_free(3) on that inner object. if obj contains an X509_CRL certificate revocation list, it calls X509_CRL_free(3) on that inner list instead. then X509_OBJECT_free() frees the storage used for obj itself. it's a whole cleanup arc, we love to see it 🧹✨

now, the search girlies 🔍:

• if type is X509_LU_X509, then X509_OBJECT_idx_by_subject() and X509_OBJECT_retrieve_by_subject() search the given stack for a certificate with the subject name.
• if type is X509_LU_CRL, they search for a certificate revocation list with the issuer name instead. plot twist, but a documented one 💅

and X509_OBJECT_retrieve_match()? she's adaptive:

• if obj contains a certificate → searches the given stack for a certificate with a matching subject name
• if it contains a certificate revocation list → searches for a certificate revocation list with a matching issuer name instead
• otherwise → searches for an X509_OBJECT with a matching type

versatile icon, honestly 🌈

---

🔥 RETURN VALUES 🔥

• X509_OBJECT_get_type() returns X509_LU_X509 if obj contains a certificate, X509_LU_CRL if it contains a certificate revocation list, or X509_LU_NONE if it contains neither. three moods, pick one 💜
• X509_OBJECT_new() returns the new object, or NULL if memory allocation fails 😭 (allocation said "not today")
• X509_OBJECT_get0_X509() returns an internal pointer to the certificate contained in obj, or NULL if obj is NULL or contains no certificate.
• X509_OBJECT_get0_X509_CRL() returns an internal pointer to the certificate revocation list contained in obj, or NULL if obj is NULL or contains no certificate revocation list.
• X509_OBJECT_idx_by_subject() returns the zero-based index of the first matching certificate or revocation list in the stack, or -1 if type is neither X509_LU_X509 nor X509_LU_CRL, or if no match is found. (yes, -1, the classic "she's not here" signal 🙈)
• X509_OBJECT_retrieve_by_subject() returns the first matching certificate or revocation list in the stack, or NULL if type is neither X509_LU_X509 nor X509_LU_CRL, or if no match is found.
• X509_OBJECT_retrieve_match() returns the first matching X509_OBJECT, or NULL if stack or obj is NULL, or if no match is found.

ngl bestie, two of these hand you an internal pointer — that's not a copy, that's borrowing the actual vibe. don't go freeing it yourself, fr fr 💀

---

👑 SEE ALSO 👑

STACK_OF(3), X509_CRL_new(3), X509_LOOKUP_new(3), X509_NAME_new(3), X509_new(3), X509_STORE_get0_objects(3), X509_STORE_get_by_subject(3), X509_STORE_load_locations(3), X509_STORE_new(3)

the whole friend group, honestly 🫶 go say hi

---

⭐ HISTORY ⭐

• X509_OBJECT_idx_by_subject(), X509_OBJECT_retrieve_by_subject(), and X509_OBJECT_retrieve_match() first appeared in OpenSSL 0.9.6 and have been available since OpenBSD 2.9. og behavior, no cap 🧚
• X509_OBJECT_get_type(), X509_OBJECT_get0_X509(), and X509_OBJECT_get0_X509_CRL() first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 6.3.
• X509_OBJECT_new() and X509_OBJECT_free() first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 7.1. the newest additions to the squad, and we're obsessed 💖

---

and that's the page, bestie!! 🎀💅 this one's from Debian, dated June 8, 2025, and it's the X509_OBJECT_GET0_X509(3) page — go forth and know your wrapper struct, periodt ✨🦋🌸