LIBRESSL-X509_GET_EXTENSION_FLAGS(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💖 X509_GET_EXTENSION_FLAGS(3) 💖

okay bestie, welcome to the Library Functions Manual page for X509_GET_EXTENSION_FLAGS(3) — manual name folded in near the top like a little name tag 🫶

🌸 NAME 🌸

X509_get_extension_flags, X509_get_key_usage, X509_get_extended_key_usage — retrieve certificate extension data, aka grab the receipts on cert extensions 💅

✨ SYNOPSIS ✨

here's the exact signature situation, no cap:

library “libcrypto” #include <openssl/x509v3.h>

uint32_t
X509_get_extension_flags(X509 *x);

uint32_t
X509_get_key_usage(X509 *x);

uint32_t
X509_get_extended_key_usage(X509 *x);

💅 DESCRIPTION 💅

these functions pull info related to the commonly used certificate extensions. iconic behavior.

X509_get_extension_flags() retrieves general info about a certificate, and it returns one or more of these flags OR'ed together:

  • EXFLAG_V1 — the cert is an obsolete version 1 certificate. vintage, but not in a cute way 🙈
  • EXFLAG_BCONS — the cert contains a basic constraints extension.
  • EXFLAG_CA — the cert contains basic constraints and asserts the CA flag.
  • EXFLAG_PROXY — the cert is a valid proxy certificate. in LibreSSL this flag is never set, periodt.
  • EXFLAG_SI — the cert is self issued (that is, subject and issuer names match).
  • EXFLAG_SS — subject and issuer names match and extension values imply it is self signed.
  • EXFLAG_FRESHEST — the freshest CRL extension is present in the cert.
  • EXFLAG_CRITICAL — the cert contains an unhandled critical extension.
  • EXFLAG_INVALID — some certificate extension values are invalid or inconsistent, and the certificate should be rejected. this bit may also be raised after an out-of-memory error while processing the X509 object, so it may not be related to the processed ASN1 object itself. scary but important 💀
  • EXFLAG_INVALID_POLICY — the NID_certificate_policies certificate extension is invalid or inconsistent, and the cert should be rejected. same OOM caveat: this bit may also be raised after an out-of-memory error while processing the X509 object, so it may not be related to the processed ASN1 object itself.
  • EXFLAG_KUSAGE — the cert contains a key usage extension. the value can be retrieved using X509_get_key_usage().
  • EXFLAG_XKUSAGE — the cert contains an extended key usage extension. the value can be retrieved using X509_get_extended_key_usage().

X509_get_key_usage() returns the value of the key usage extension. if key usage is present, it returns zero or more of these flags:

  • KU_DIGITAL_SIGNATURE
  • KU_NON_REPUDIATION
  • KU_KEY_ENCIPHERMENT
  • KU_DATA_ENCIPHERMENT
  • KU_KEY_AGREEMENT
  • KU_KEY_CERT_SIGN
  • KU_CRL_SIGN
  • KU_ENCIPHER_ONLY
  • KU_DECIPHER_ONLY

these correspond to individual key usage bits 💫 if key usage is absent, UINT32_MAX is returned.

the following aliases for these flags are defined in <openssl/x509.h>:

  • X509v3_KU_DIGITAL_SIGNATURE
  • X509v3_KU_NON_REPUDIATION
  • X509v3_KU_KEY_ENCIPHERMENT
  • X509v3_KU_DATA_ENCIPHERMENT
  • X509v3_KU_KEY_AGREEMENT
  • X509v3_KU_KEY_CERT_SIGN
  • X509v3_KU_CRL_SIGN
  • X509v3_KU_ENCIPHER_ONLY
  • X509v3_KU_DECIPHER_ONLY

X509_get_extended_key_usage() returns the value of the extended key usage extension. if extended key usage is present, it returns zero or more of these flags:

  • XKU_SSL_SERVER
  • XKU_SSL_CLIENT
  • XKU_SMIME
  • XKU_CODE_SIGN
  • XKU_OCSP_SIGN
  • XKU_TIMESTAMP
  • XKU_DVCS
  • XKU_ANYEKU

these correspond to the OIDs "id-kp-serverAuth", "id-kp-clientAuth", "id-kp-emailProtection", "id-kp-codeSigning", "id-kp-OCSPSigning", "id-kp-timeStamping", "id-kp-dvcs", and "anyExtendedKeyUsage", respectively 🎀

plus, XKU_SGC is set if either Netscape or Microsoft SGC OIDs are present. extra little bonus flag.

the value of the flags correspond to extension values which are cached in the X509 structure. if the flags returned do not provide sufficient information, an application should examine extension values directly, for example using X509_get_ext_d2i(3).

if the key usage or extended key usage extension is absent then typically usage is unrestricted. for this reason X509_get_key_usage() and X509_get_extended_key_usage() return UINT32_MAX when the corresponding extension is absent. applications can additionally check the return value of X509_get_extension_flags() and take appropriate action if an extension is absent.

🫶 RETURN VALUES 🫶

X509_get_extension_flags(), X509_get_key_usage() and X509_get_extended_key_usage() return sets of flags corresponding to the certificate extension values. that's the tea ☕

🦋 SEE ALSO 🦋

⭐ HISTORY ⭐

X509_get_extension_flags, X509_get_key_usage, and X509_get_extended_key_usage first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 7.1. glow-up timeline ✨

byeee 💋 this page is from the Debian source/version, dated June 8, 2025, and the manual title is X509_GET_EXTENSION_FLAGS(3) — slay and stay safe 🫶

📦 where this page comes from