X509_CHECK_CA(3)

✨ X509_CHECK_CA(3) ✨

okay bestie, welcome to the libcrypto girlies' corner of the manual — page 3, we're in the library functions section, and this one is short but SO important 🎀

---

🌸 NAME 🌸

X509_check_ca — the lil vibe check that tells you whether a certificate is a CA certificate 💅

---

🦋 SYNOPSIS 🦋

first up, it's the libcrypto library, and you pull in the header like this:

#include <openssl/x509v3.h>

int
X509_check_ca(X509 *cert);

that's it. one function, one pointer, no drama ✨

---

💖 DESCRIPTION 💖

so X509_check_ca() looks at the certificate you hand it and answers the question: is this a CA certificate? 👑

and "CA certificate" here means one specific thing — like, is it allowed to sign other certificates? that's the whole entire job. nothing else. no extra credit, no side quests 🫶

---

🔥 RETURN VALUES 🔥

if cert IS a CA certificate, you get a non-zero value back. if it's not, you get 0. periodt 💀

but wait, there's more — because the non-zero values aren't all the same, and they're actually giving very specific info about what kind of CA cert you're holding. here's the tea:

• 1 — an X.509 v3 CA certificate with a basicConstraints extension set to CA:TRUE 👑 the classic, the original, the main character
• 3 — a self-signed X.509 v1 certificate 🫶 old school and signing itself, we love a self-sufficient icon
• 4 — a certificate that has a keyUsage extension with the bit keyCertSign set, but is missing basicConstraints 🙈 no cap, it's doing the job without the paperwork
• 5 — a certificate with an outdated Netscape Certificate Type extension that says it's a CA certificate 💀 vintage, deprecated, but still showing up to the function

---

⭐ SEE ALSO ⭐

the friend group, all on page 3, go say hi:

• BASIC_CONSTRAINTS_new(3)
• EXTENDED_KEY_USAGE_new(3)
• X509_check_issued(3)
• X509_check_purpose(3)
• X509_EXTENSION_new(3)
• X509_new(3)
• X509_verify_cert(3)

---

🎀 HISTORY 🎀

X509_check_ca() first appeared in OpenSSL 0.9.7f, and it's been living rent-free on the scene since OpenBSD 3.8. a legacy icon fr fr 🧚

---

💀 BUGS 💀

okay so this is the part where you gotta pay attention, bestie, because this is a real gotcha 🙈

if X509_check_ca() fails to cache X509v3 extension values, it may end up failing to recognize a CA certificate. like, it'll be wrong. not it.

the fix? an application should call X509_check_purpose(3) with a purpose argument of -1 — that makes sure the X509v3 extensions actually get cached — before calling X509_check_ca() 💅

lowkey do this. every time. your future self will thank you 🫶

---

and that's the page!! brought to you by the libcrypto library functions manual, straight outta Debian, dated September 19, 2026 — mwah, slay, go forth and validate those CAs ✨👑💖