X509_GET_VERSION(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

okay so bestie, welcome to the X509_GET_VERSION(3) page — it lives in the Library Functions Manual, and it's literally the main character energy for version fields on certs, cert requests, and CRLs. 🎀✨ No cap.

✨ NAME ✨

X509_get_version, X509_set_version, X509_REQ_get_version, X509_REQ_set_version, X509_CRL_get_version, X509_CRL_set_version — get or set certificate, certificate request, or CRL version. Slay. 💅

🌸 SYNOPSIS 🌸

This is the libcrypto link-up + the header, fr fr:

library “libcrypto” #include <openssl/x509.h>

Then the signatures, exactly:

long
X509_get_version(const X509 *x);

int
X509_set_version(X509 *x, long version);

long
X509_REQ_get_version(const X509_REQ *req);

int
X509_REQ_set_version(X509_REQ *x, long version);

long
X509_CRL_get_version(const X509_CRL *crl);

int
X509_CRL_set_version(X509_CRL *x, long version);

🦋 DESCRIPTION 🦋

X509_get_version() returns the numerical value of the version field of certificate x. This is giving “off by one, but make it standards”: it's defined by standards (X.509 et al.) to be one less than the certificate version. So a version 3 certificate will return 2, and a version 1 certificate will return 0. iykyk. 🫶

bestie, do not freestyle this — it's literally defined by standards (X.509 et al.) to be one less than the certificate version. That's not a bug, that's the vibe. 💀

X509_set_version() sets the numerical value of the version field of certificate x to version. Periodt. ✨

Similarly, X509_REQ_get_version(), X509_REQ_set_version(), X509_CRL_get_version(), and X509_CRL_set_version() get and set the version number of certificate requests and CRLs. No cap. 🎀

The version field of certificates, certificate requests, and CRLs has a DEFAULT value of v1(0) — meaning the field should be omitted for version 1. These functions handle that transparently, so you don't have to lowkey stress. 🌈

👑 RETURN VALUES 👑

X509_get_version(), X509_REQ_get_version(), and X509_CRL_get_version() return the numerical value of the version field. Highkey iconic. 💖

X509_set_version(), X509_REQ_set_version(), and X509_CRL_set_version() return 1 for success or 0 for failure. In some cases of failure, the reason can be determined with ERR_get_error(3). Not me crying about the failure case. 😭

🔥 SEE ALSO 🔥

Go give these a vibe check, bestie: d2i_X509(3), X509_CRL_get0_by_serial(3), X509_CRL_new(3), X509_get_pubkey(3), X509_get_subject_name(3), X509_NAME_add_entry_by_txt(3), X509_NAME_ENTRY_get_object(3), X509_NAME_get_index_by_NID(3), X509_NAME_print_ex(3), X509_new(3), X509_REQ_new(3), X509_sign(3), X509_verify_cert(3), X509V3_get_d2i(3). 🫶

⭐ HISTORY ⭐

The lore, because we love a backstory:

  • X509_get_version(), X509_set_version(), X509_REQ_get_version(), and X509_REQ_set_version() first appeared in SSLeay 0.6.5 and have been available since OpenBSD 2.4. 🎀
  • X509_CRL_get_version() first appeared in OpenSSL 0.9.2b and has been available since OpenBSD 2.6. 🦋
  • X509_CRL_set_version() first appeared in OpenSSL 0.9.7 and has been available since OpenBSD 3.2. 🌸

💖 this page is from Debian, dated June 8, 2025, and it's literally the X509_GET_VERSION(3) manual — mwah, bye bestie! 💅✨

📦 where this page comes from