X509_SIGN(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

🌸 NAME 🌸

okay so bestie, welcome to X509_SIGN(3) from the Library Functions Manual — this is the libcrypto page for signing and verifying certificate, certificate request, or CRL signatures. The whole squad is:

  • X509_sign
  • X509_sign_ctx
  • X509_verify
  • X509_REQ_sign
  • X509_REQ_sign_ctx
  • X509_REQ_verify
  • X509_CRL_sign
  • X509_CRL_sign_ctx
  • X509_CRL_verify

— sign or verify certificate, certificate request, or CRL signature 💅

✨ SYNOPSIS ✨

exact lineup, no edits, iykyk:

library “libcrypto” #include <openssl/x509.h>

int
X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);

int
X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx);

int
X509_verify(X509 *x, EVP_PKEY *pkey);

int
X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md);

int
X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx);

int
X509_REQ_verify(X509_REQ *x, EVP_PKEY *pkey);

int
X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md);

int
X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx);

int
X509_CRL_verify(X509_CRL *x, EVP_PKEY *pkey);

🦋 DESCRIPTION 🦋

  • X509_sign() — signs the certificate x using the private key pkey and the message digest md, and sets the signature in x. slay.
  • X509_sign_ctx() — also signs the certificate x, but uses the parameters contained in digest context ctx.
  • X509_verify() — verifies the signature of certificate x using the public key pkey. Be so for real: only the signature is checked; no other checks (such as certificate chain validity) are performed.
  • X509_REQ_sign(), X509_REQ_sign_ctx(), X509_REQ_verify(), X509_CRL_sign(), X509_CRL_sign_ctx(), and X509_CRL_verify() — sign and verify certificate requests and CRLs, respectively. iconic.
  • X509_sign_ctx() — used where the default parameters for the corresponding public key and digest are not suitable. It can be used to sign keys using RSA-PSS for example. that's the special-case queen.

🎀 RETURN VALUES 🎀

  • X509_sign(), X509_sign_ctx(), X509_REQ_sign(), X509_REQ_sign_ctx(), X509_CRL_sign(), and X509_CRL_sign_ctx() — return the size of the signature in bytes for success or 0 for failure. periodt.
  • X509_verify(), X509_REQ_verify(), and X509_CRL_verify() — return 1 if the signature is valid or 0 if the signature check fails. If the signature could not be checked at all because it was invalid or some other error occurred, then -1 is returned. 💀
  • In some cases of failure, the reason can be determined with ERR_get_error(3).

🔥 SEE ALSO 🔥

go read these next, bestie:

🌈 HISTORY 🌈

  • X509_verify() appeared in SSLeay 0.4 or earlier.
  • X509_sign() and X509_REQ_sign() first appeared in SSLeay 0.4.4.
  • X509_REQ_verify() and X509_CRL_verify() first appeared in SSLeay 0.4.5b.
  • X509_CRL_sign() first appeared in SSLeay 0.5.1.
  • These functions have been available since OpenBSD 2.4.
  • X509_sign_ctx(), X509_REQ_sign_ctx(), and X509_CRL_sign_ctx() first appeared in OpenSSL 1.0.1 and have been available since OpenBSD 5.3.

that's the whole X509_SIGN(3) tea, bestie — brought to you by Debian, July 11, 2025 💖✨

📦 where this page comes from