X509V3_GET_EXT_BY_NID(3)

💅 X509V3_GET_EXT_BY_NID(3) — Library Functions Manual ✨

okay so bestie, this page is literally the extension stack utility functions page from libcrypto, and yes the title is X509V3_GET_EXT_BY_NID(3) even though it's about like... thirty functions. iconic behavior, we don't question it 🎀

---

🌸 NAME 🌸

Ngl this is a whole friend group, so let me just introduce everyone. All of these live in libcrypto and they're all about extension stack utility functions:

• X509v3_get_ext_count, X509v3_get_ext, X509v3_get_ext_by_NID, X509v3_get_ext_by_OBJ, X509v3_get_ext_by_critical, X509v3_delete_ext, X509v3_add_ext
• X509_get_ext_count, X509_get_ext, X509_get_ext_by_NID, X509_get_ext_by_OBJ, X509_get_ext_by_critical, X509_delete_ext, X509_add_ext
• X509_CRL_get_ext_count, X509_CRL_get_ext, X509_CRL_get_ext_by_NID, X509_CRL_get_ext_by_OBJ, X509_CRL_get_ext_by_critical, X509_CRL_delete_ext, X509_CRL_add_ext
• X509_REVOKED_get_ext_count, X509_REVOKED_get_ext, X509_REVOKED_get_ext_by_NID, X509_REVOKED_get_ext_by_OBJ, X509_REVOKED_get_ext_by_critical, X509_REVOKED_delete_ext, X509_REVOKED_add_ext

— extension stack utility functions 💖

---

✨ SYNOPSIS ✨

First things first, bestie: it's the library “libcrypto” girlies, and you gotta bring in the header like so:

#include <openssl/x509.h>

and then the whole cast, in their natural habitat 🦋

int
X509v3_get_ext_count(const STACK_OF(X509_EXTENSION) *x);

X509_EXTENSION *
X509v3_get_ext(const STACK_OF(X509_EXTENSION) *x, int loc);

int
X509v3_get_ext_by_NID(const STACK_OF(X509_EXTENSION) *x, int nid,
    int lastpos);

int
X509v3_get_ext_by_OBJ(const STACK_OF(X509_EXTENSION) *x,
    const ASN1_OBJECT *obj, int lastpos);

int
X509v3_get_ext_by_critical(const STACK_OF(X509_EXTENSION) *x, int crit,
    int lastpos);

X509_EXTENSION *
X509v3_delete_ext(STACK_OF(X509_EXTENSION) *x, int loc);

STACK_OF(X509_EXTENSION) *
X509v3_add_ext(STACK_OF(X509_EXTENSION) **x, X509_EXTENSION *ex,
    int loc);

int
X509_get_ext_count(const X509 *x);

X509_EXTENSION *
X509_get_ext(const X509 *x, int loc);

int
X509_get_ext_by_NID(const X509 *x, int nid, int lastpos);

int
X509_get_ext_by_OBJ(const X509 *x, const ASN1_OBJECT *obj, int lastpos);

int
X509_get_ext_by_critical(const X509 *x, int crit, int lastpos);

X509_EXTENSION *
X509_delete_ext(X509 *x, int loc);

int
X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc);

int
X509_CRL_get_ext_count(const X509_CRL *x);

X509_EXTENSION *
X509_CRL_get_ext(const X509_CRL *x, int loc);

int
X509_CRL_get_ext_by_NID(const X509_CRL *x, int nid, int lastpos);

int
X509_CRL_get_ext_by_OBJ(const X509_CRL *x, const ASN1_OBJECT *obj,
    int lastpos);

int
X509_CRL_get_ext_by_critical(const X509_CRL *x, int crit, int lastpos);

X509_EXTENSION *
X509_CRL_delete_ext(X509_CRL *x, int loc);

int
X509_CRL_add_ext(X509_CRL *x, X509_EXTENSION *ex, int loc);

int
X509_REVOKED_get_ext_count(const X509_REVOKED *x);

X509_EXTENSION *
X509_REVOKED_get_ext(const X509_REVOKED *x, int loc);

int
X509_REVOKED_get_ext_by_NID(const X509_REVOKED *x, int nid,
    int lastpos);

int
X509_REVOKED_get_ext_by_OBJ(const X509_REVOKED *x,
    const ASN1_OBJECT *obj, int lastpos);

int
X509_REVOKED_get_ext_by_critical(const X509_REVOKED *x, int crit,
    int lastpos);

X509_EXTENSION *
X509_REVOKED_delete_ext(X509_REVOKED *x, int loc);

int
X509_REVOKED_add_ext(X509_REVOKED *x, X509_EXTENSION *ex, int loc);

---

🎀 DESCRIPTION 🎀

okay so sit down, grab a lil drink, we're going through the whole lore 🍓

X509v3_get_ext_count() retrieves the number of extensions in x. That's it. That's the whole vibe.

X509v3_get_ext() retrieves extension loc from x. The index loc can take any value from 0 to X509_get_ext_count(x) - 1. And heads up bestie — the returned extension is an internal pointer, so you must not free it up from your application. don't do it. it's not yours. 🙈

X509v3_get_ext_by_NID() and X509v3_get_ext_by_OBJ() look for an extension with nid or obj from extension stack x. The search starts from the extension after lastpos, or from the beginning if lastpos is -1. If the extension is found, its index is returned; otherwise, a negative value is returned. slay.

X509v3_get_ext_by_critical() is similar to X509v3_get_ext_by_NID() except that it looks for an extension of criticality crit. A 0 value for crit looks for a non-critical extension; a non-zero value looks for a critical extension. critical queen behavior tbh 👑

X509v3_delete_ext() deletes the extension with index loc from x. The deleted extension is returned and must be freed by the caller — that one's yours, bestie, take care of it. If loc is an invalid index value, NULL is returned.

X509v3_add_ext() adds the extension ex to the stack *x at position loc. If loc is -1, the new extension is added to the end. If *x is NULL, a new stack will be allocated. The passed extension ex is duplicated internally, so it must be freed after use. copy-paste energy fr fr 🫶

---

🦋 the certificate girlies

X509_get_ext_count(), X509_get_ext(), X509_get_ext_by_NID(), X509_get_ext_by_OBJ(), X509_get_ext_by_critical(), X509_delete_ext(), and X509_add_ext() operate on the extensions of certificate x. They are otherwise identical to the X509v3 functions.

🌈 the CRL girlies

X509_CRL_get_ext_count(), X509_CRL_get_ext(), X509_CRL_get_ext_by_NID(), X509_CRL_get_ext_by_OBJ(), X509_CRL_get_ext_by_critical(), X509_CRL_delete_ext(), and X509_CRL_add_ext() operate on the extensions of the CRL x. They are otherwise identical to the X509v3 functions.

💜 the CRL entry girlies

X509_REVOKED_get_ext_count(), X509_REVOKED_get_ext(), X509_REVOKED_get_ext_by_NID(), X509_REVOKED_get_ext_by_OBJ(), X509_REVOKED_get_ext_by_critical(), X509_REVOKED_delete_ext(), and X509_REVOKED_add_ext() operate on the extensions of the CRL entry x. They are otherwise identical to the X509v3 functions.

---

💀 important notes, no cap 💀

These functions are used to examine stacks of extensions directly. Many applications will want to parse or encode and add an extension: they should use the extension encode and decode functions instead, such as X509_get_ext_d2i(3). like, read that again. it's giving "you're using the wrong tool bestie" 😭

Extension indices start from zero, so a zero index return value is not an error. Do not panic. Do not text your ex. It's fine.

⚠️ These search functions start from the extension after the lastpos parameter, so it should initially be set to -1. If it is set to 0, the initial extension will not be checked — and that's how you get mystery bugs at 3am. you've been warned 🧚

---

🔥 RETURN VALUES 🔥

• X509v3_get_ext_count() returns the extension count. ✨
• X509v3_get_ext(), X509v3_delete_ext(), and X509_delete_ext() return an X509_EXTENSION pointer or NULL if an error occurs.
• X509v3_get_ext_by_NID(), X509v3_get_ext_by_OBJ(), and X509v3_get_ext_by_critical() return the extension index or -1 if an error occurs. In addition, X509v3_get_ext_by_NID() returns -2 if OBJ_nid2obj(3) fails on the requested nid. yes, -2. it's a whole thing.
• X509v3_add_ext() returns a stack of extensions or NULL on error.
• X509_add_ext() returns 1 on success or 0 on error.

---

🌟 SEE ALSO 🌟

OBJ_nid2obj(3), X509_CRL_new(3), X509_EXTENSION_new(3), X509_new(3), X509_REVOKED_new(3), X509V3_EXT_print(3), X509V3_extensions_print(3), X509V3_get_d2i(3)

---

⭐ HISTORY ⭐

These functions first appeared in SSLeay 0.8.0 and have been available since OpenBSD 2.4. vintage. retro. literally older than the vibe but we respect the elders 👑

---

k bye bestie, go forth and stack your extensions responsibly 💖✨

mwah 💋 — this page came to you from Debian, dated June 8, 2025, page X509V3_GET_EXT_BY_NID(3) 🎀