X509_VERIFY_CERT(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

🌸 NAME 🌸

X509_verify_cert — discover and verify X509 certificate chain ✨

okay so bestie, this is the X509_VERIFY_CERT(3) manual page, and we are literally talking about X509_verify_cert, the function whose whole main character energy is discovering and verifying an X509 certificate chain. no cap. 💅

🎀 SYNOPSIS 🎀

library “libcrypto” #include <openssl/x509.h>

int
X509_verify_cert(X509_STORE_CTX *ctx);

🦋 DESCRIPTION 🦋

The X509_verify_cert() function attempts to discover and validate a certificate chain based on parameters in ctx. it's giving “find the chain and vibe check it” 🧚✨

Applications rarely call this function directly, but it is used by OpenSSL internally for certificate validation, in both the S/MIME and SSL/TLS code. so like, most apps are not calling this one directly — OpenSSL is lowkey using it behind the scenes for cert validation in both S/MIME and SSL/TLS. highkey iykyk. 💖

✨ RETURN VALUES ✨

If a complete chain can be built and validated this function returns 1 — slay, the chain ate and left no crumbs. 🎉👑

Otherwise it returns a value <= 0 indicating failure. 😭 not the failure value bestie.

Additional error information can be obtained by examining ctx, using X509_STORE_CTX_get_error(3). that's your lil detective move when something goes sideways. 🔍🫶

🌈 SEE ALSO 🌈

💜 HISTORY 💜

X509_verify_cert() first appeared in SSLeay 0.8.0 and has been available since OpenBSD 2.4. iconic, honestly. periodt. 👑💜

💀 BUGS 💀

This function uses the header <openssl/x509.h> as opposed to most chain verification functions which use <openssl/x509_vfy.h>. not me being quirky with headers 🙈 — this is a real bug note, so keep it in mind, fr fr.

okay bestie, that's the whole page! this cutie is from Debian, dated June 8, 2025, and yes — the manual name is X509_VERIFY_CERT(3). 🫶💖🎀

📦 where this page comes from