LIBRESSL-X509_GET_PUBKEY_PARAMETERS(3)

💖 NAME 💖

Okay bestie, meet X509_get_pubkey_parameters — copy public key parameters from a chain. This is the LIBRESSL-X509_GET_PUBKEY_PARAMETERS(3) page from the Library Functions Manual; the source header spells it X509_GET_PUBKEY_PARAMETE(3) (tiny typo, we still love her 💀). It's a libcrypto situation, and yes, she's serving chain-parameter-copying realness. 🫶

✨ SYNOPSIS ✨

library “libcrypto” #include <openssl/x509.h>

int
X509_get_pubkey_parameters(EVP_PKEY *pkey, STACK_OF(X509) *chain);

🌸 DESCRIPTION 🌸

So what does X509_get_pubkey_parameters() do? It copies public key parameters from the first appropriate certificate in the chain. That's the main character move. 💅

Here's the vibe check on pkey:

• If pkey is not NULL and already contains complete public key parameters, or if it uses an algorithm that does not use any parameters, then no action occurs, and the function indicates success. It does this without inspecting the existing parameters, without inspecting the chain, and without comparing any parameters. Literally not even peeking. 🙈

Otherwise, all public key parameters are copied from the first certificate in the chain that contains complete public key parameters to each certificate preceding it in the chain. Unless pkey is a NULL pointer, the same parameters are also copied to pkey. Periodt. ✨

🎀 RETURN VALUES 🎀

X509_get_pubkey_parameters() returns 1 for success or 0 for failure. That's it, that's the whole report card. 💖

😭 ERRORS 😭

You can retrieve the following diagnostics with ERR_get_error(3), ERR_GET_REASON(3), and ERR_reason_error_string(3):

• X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY — "unable to get certs public key" — retrieving the public key from a certificate in the chain failed before a certificate containing complete public key parameters could be found.
• X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN — "unable to find parameters in chain" — none of the certificates in the chain contain complete public key parameters.

🦋 SEE ALSO 🦋

Go be nosy, bestie: EVP_PKEY_copy_parameters(3), EVP_PKEY_new(3), X509_get_pubkey(3), X509_new(3). 📚

👑 HISTORY 👑

X509_get_pubkey_parameters() first appeared in SSLeay 0.8.0 and has been available since OpenBSD 2.4. She's vintage, she's iconic, she's been in the group chat since forever. 💜

💀 CAVEATS 💀

If X509_get_pubkey_parameters() fails and returns 0, a part of the parameters may or may not have been copied before the failure was detected, whereas other parts of pkey and chain may remain unchanged. So in case of failure, the state of the arguments may change and possibly become inconsistent.

So yeah — on failure, the arguments can be left in a messy little state, and possibly inconsistent. Not a clean rollback moment, bestie. 🫠

---

This page is from Debian, dated June 8, 2025, and it lives at X509_GET_PUBKEY_PARAMETERS(3) — mwah 💋✨