S2I_ASN1_INTEGER(3)

💅 S2I_ASN1_INTEGER(3) — like, the libcrypto library functions manual, section 3, bestie ✨

Okay so this page is S2I_ASN1_INTEGER(3) from the Library Functions Manual, and it's about a whole little friend group of functions that convert ASN.1 stuff back and forth. Buckle up, it's actually not that deep, I promise 🫶

---

✨ NAME ✨

i2s_ASN1_ENUMERATED, i2s_ASN1_ENUMERATED_TABLE, i2s_ASN1_INTEGER, s2i_ASN1_INTEGER, i2s_ASN1_OCTET_STRING, s2i_ASN1_OCTET_STRING — the ASN.1 data type conversion utilities for certificate extensions. That's the whole squad 💖

---

🌸 SYNOPSIS 🌸

library “libcrypto” #include <openssl/asn1.h>
#include <openssl/x509v3.h>

char *
i2s_ASN1_ENUMERATED(X509V3_EXT_METHOD *method,
    const ASN1_ENUMERATED *a);

char *
i2s_ASN1_INTEGER(X509V3_EXT_METHOD *method, const ASN1_INTEGER *a);

ASN1_INTEGER *
s2i_ASN1_INTEGER(X509V3_EXT_METHOD *method, const char *value);

char *
i2s_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method,
    const ASN1_OCTET_STRING *aos);

ASN1_OCTET_STRING *
s2i_ASN1_OCTET_STRING(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
    const char *value);

char *
i2s_ASN1_ENUMERATED_TABLE(X509V3_EXT_METHOD *method,
    const ASN1_ENUMERATED *a);

---

🦋 DESCRIPTION 🦋

So these functions convert to and from ASN1_ENUMERATED, ASN1_INTEGER, and ASN1_OCTET_STRING objects. Where you'll actually see them? Mostly internally, for parsing config files and for displaying X.509v3 certificate extensions — very behind-the-scenes main character energy 👑

Real talk: with the one exception of i2s_ASN1_ENUMERATED_TABLE(), these functions just ignore the method argument. Like, don't even worry about it.

⚠️ Any object or string returned by these functions must be freed by the caller. Yes, that includes you. Free it. Don't be that person 😭

💜 the i2s girlies (object → string)

i2s_ASN1_ENUMERATED() and i2s_ASN1_INTEGER() first convert a into a BIGNUM object using ASN1_ENUMERATED_to_BN(3) or ASN1_INTEGER_to_BN(3), and then they derive a string representation using BN_bn2dec(3) or BN_bn2hex(3).

Which one wins? Decimal representation is used if the number has less than 128 bits. Otherwise it goes hexadecimal, and the reason is honestly so real of it: to avoid excessive conversion cost 🔥

💜 s2i_ASN1_INTEGER()

s2i_ASN1_INTEGER() goes the other way — it converts the NUL-terminated decimal or hexadecimal string representation of an integer in value into an ASN1_INTEGER object.

The deets on parsing:

• A sign prefix of '-' means it's a negative number
• The base prefixes 0x and 0X mean hexadecimal representation
• Otherwise, decimal representation is assumed (default behaviour, slay)

After skipping the sign and base prefixes, it does an intermediate conversion into a BIGNUM using BN_dec2bn(3) or BN_hex2bn(3), and the ASN1_INTEGER is then obtained with BN_to_ASN1_INTEGER(3). Three steps, one gorgeous result ✨

💜 i2s_ASN1_OCTET_STRING()

i2s_ASN1_OCTET_STRING() converts the octets in aos into a string where the octets are colon-separated and represented as pairs of uppercase hexadecimal digits. It's giving MAC address aesthetic, ngl 🎀

💜 s2i_ASN1_OCTET_STRING()

s2i_ASN1_OCTET_STRING() converts the NUL-terminated string str into an ASN1_OCTET_STRING. (Yep, the prose calls it str and the synopsis calls it value — the docs said what they said, iykyk 🙈)

The method and ctx arguments are ignored. Every pair of hexadecimal digits gets converted into an octet. And colons? They're ignored if they're at the start, at the end, or if they separate two pairs of digits. Very chill of them 💅

💜 i2s_ASN1_ENUMERATED_TABLE()

i2s_ASN1_ENUMERATED_TABLE() is the special one — it actually uses the method argument. It looks up the value of a in the usr_data field of the non-NULL method and returns a copy of the associated long name. Cute 🥰

If no match is found, a gets passed to i2s_ASN1_ENUMERATED() instead. Fallback queen.

The method argument can be provided by application programs, or it can be a default method obtained from X509V3_EXT_get_nid(3).

And these default methods have strings configured in their usr_data field for the following nid arguments:

• NID_crl_reason — reason codes, RFC 5280, 5.3.1
• NID_key_usage — key usage, RFC 5280, 4.2.1.3
• NID_netscape_cert_type — Netscape certificate type (obsolete)

👀 Shoutout to NID_netscape_cert_type for being obsolete. We still love her, but she's retired.

---

🌈 RETURN VALUES 🌈

i2s_ASN1_ENUMERATED(), i2s_ASN1_ENUMERATED_TABLE(), i2s_ASN1_INTEGER(), and i2s_ASN1_OCTET_STRING() all return a NUL-terminated string — or NULL on memory allocation failure 😭

s2i_ASN1_INTEGER() returns an ASN1_INTEGER, or NULL on error. The error conditions here are: memory allocation failure, or value not being a valid decimal or hexadecimal encoding of an integer. That second one is on you, bestie 💀

s2i_ASN1_OCTET_STRING() returns an ASN1_OCTET_STRING, or NULL on error. Its error conditions: memory allocation failure, or value containing an odd number of hexadecimal digits, or containing anything except colons at the start, at the end, or between pairs of hexadecimal digits. The rules are the rules 🚫

Error codes can sometimes be obtained by ERR_get_error(3). Sometimes! Not always! It's giving mystery ✨

---

⭐ SEE ALSO ⭐

a2i_ASN1_INTEGER(3), a2i_ipadd(3), ASN1_INTEGER_new(3), ASN1_INTEGER_to_BN(3), ASN1_OCTET_STRING_new(3), crypto(3), v2i_ASN1_BIT_STRING(3), X509V3_get_d2i(3)

Go read those too, that's your homework 🎀

---

🧚 HISTORY 🧚

These functions first appeared in OpenSSL 0.9.4 and have been available since OpenBSD 2.6. Absolute veterans. Elders of the group chat 👑

---

💀 BUGS 💀

Okay so this is the messy part and I'm not gonna sugarcoat it: of these functions, at least i2s_ASN1_ENUMERATED_TABLE() can succeed while setting an error — and fail without setting an error on the error stack.

Not me looking at the error stack like 👁️👄👁️ — it's giving chaos, fr fr. Just be aware.

---

✨ that's the whole page, bestie ✨

This one's from the Debian package, dated August 18, 2026, and it's S2I_ASN1_INTEGER(3) all the way down. Now go forth and convert some ASN.1 💖🎀🦋