NE_SSL_CLIENT_CERT(3)

🎀 NE_SSL_CLIENT_CERT(3) 🎀

okay so this is from the neon API reference, and the manual page is literally NE_SSL_CLIENT_CERT(3). Bestie, we’re doing SSL client certificate handling today, and yes it’s giving secure, it’s giving encrypted, it’s giving “please don’t leak the private key.” 💅✨

✨ NAME ✨

ne_ssl_clicert_read, ne_ssl_clicert_import, ne_ssl_clicert_fromuri, ne_ssl_clicert_name, ne_ssl_clicert_encrypted, ne_ssl_clicert_decrypt, ne_ssl_clicert_owner, ne_ssl_clicert_free — SSL client certificate handling. That’s the whole squad right there. 🫶

🌸 SYNOPSIS 🌸

       #include <ne_ssl.h>

       ne_ssl_client_cert *ne_ssl_clicert_read(const char *filename);

       ne_ssl_client_cert *ne_ssl_clicert_import(const unsigned char *filename,
                                                 size_t buflen);

       ne_ssl_client_cert *ne_ssl_clicert_fromuri(const char *uri,
                                                  unsigned flags);

       const char *ne_ssl_clicert_name(const ne_ssl_client_cert *ccert);

       int ne_ssl_clicert_encrypted(const ne_ssl_client_cert *ccert);

       int ne_ssl_clicert_decrypt(ne_ssl_client_cert *ccert,
                                  const char *password);

       const ne_ssl_certificate
                                                      *ne_ssl_clicert_owner(const ne_ssl_client_cert *ccert);

       void ne_ssl_clicert_free(ne_ssl_client_cert *ccert);

💖 DESCRIPTION 💖

okay so ne_ssl_clicert_read reads a client certificate from a PKCS#12-formatted file, and returns an ne_ssl_client_cert object. Meanwhile ne_ssl_clicert_import reads a client certificate from a memory buffer using the PKCS#12 format. And ne_ssl_clicert_fromuri loads a client certificate from a URI. The URI schemes supported are defined by the SSL/TLS toolkit, and may include PKCS#11 URIs[1]. Slay. 🎀

An ne_ssl_client_cert object represents both a client certificate and the associated private key; the term “client certificate” is used here to refer to this pair. A client certificate object loaded by any of the above functions can be in one of two states: encrypted or decrypted. ne_ssl_clicert_encrypted will return non-zero if the client certificate is in the encrypted state. 🔐

A client certificate must be in the decrypted state before it is associated with a session. ne_ssl_clicert_decrypt can be used to decrypt a client certificate using the appropriate password.

⚠️ bestie, listen: ne_ssl_clicert_decrypt must only be called if the object is in the encrypted state. If decryption fails, the certificate state does not change, so decryption can be attempted more than once using different passwords. No cap.

A client certificate can be given a “friendly name” when it is created; ne_ssl_clicert_name will return this name (or NULL if no friendly name was specified). ne_ssl_clicert_name can be used when the client certificate is in either the encrypted or decrypted state, and will return the same string for the lifetime of the object. It’s consistent, iconic behavior. 🌟

The function ne_ssl_clicert_owner returns the certificate part of the client certificate; it must only be called if the client certificate is in the decrypted state. 🫶

When the client certificate object is no longer needed, the ne_ssl_clicert_free function should be used to destroy the object. Clean up after yourself, periodt. 🧚

⭐ RETURN VALUE ⭐

• ne_ssl_clicert_read, ne_ssl_clicert_import, and ne_ssl_clicert_fromuri — all return a client certificate object, or NULL if the certificate could not be read/imported. 😭
• ne_ssl_clicert_encrypted — returns zero if the object is in the decrypted state, or non-zero if it is in the encrypted state. 💀
• ne_ssl_clicert_name — returns a NUL-terminated friendly name string, or NULL. 🎀
• ne_ssl_clicert_owner — returns a certificate object. 👑

🔥 EXAMPLES 🔥

The following code reads a client certificate and decrypts it if necessary, then loads it into an HTTP session. This is the little glow-up sequence, fr fr:

           ne_ssl_client_cert *ccert;

           ccert = ne_ssl_clicert_read("/path/to/client.p12");

           if (ccert == NULL) {
              /* handle error... */
           } else if (ne_ssl_clicert_encrypted(ccert)) {
              char *password = prompt_for_password();

              if (ne_ssl_clicert_decrypt(ccert, password)) {
                 /* could not decrypt! handle error... */
              }
           }

           ne_ssl_set_clicert(sess, ccert);

🌈 HISTORY 🌈

• ne_ssl_clicert_import was added in neon 0.30.0. 🕰️
• ne_ssl_clicert_fromuri was added in neon 0.35.0. ✨

👀 SEE ALSO 👀

• ne_ssl_cert_read(3)

💜 COPYRIGHT 💜

Copyright © 2001-2026 Joe Orton

🦋 REFERENCES 🦋

1. PKCS#11 URIs — https://www.rfc-editor.org/rfc/rfc7512.html

💖 with love from neon, dated 03/20/2026, this was NE_SSL_CLIENT_CERT(3) — now go forth and keep those client certs decrypted and cute. 🫶✨