SCT_VALIDATE(3ossl)

💅 SCT_VALIDATE — checks Signed Certificate Timestamps (SCTs) are valid

okay bestie, so this is from the OpenSSL manual, section 3ossl — yes we're in library-function territory, buckle up 🎀

This page covers three functions: SCT_validate, SCT_LIST_validate, and SCT_get_validation_status. Their whole job? Checking that Signed Certificate Timestamps (SCTs) are actually valid. Not fake-valid. Valid valid. ✨

---

🌸 SYNOPSIS 🌸

#include <openssl/ct.h>

typedef enum {
    SCT_VALIDATION_STATUS_NOT_SET,
    SCT_VALIDATION_STATUS_UNKNOWN_LOG,
    SCT_VALIDATION_STATUS_VALID,
    SCT_VALIDATION_STATUS_INVALID,
    SCT_VALIDATION_STATUS_UNVERIFIED,
    SCT_VALIDATION_STATUS_UNKNOWN_VERSION
} sct_validation_status_t;

int SCT_validate(SCT *sct, const CT_POLICY_EVAL_CTX *ctx);
int SCT_LIST_validate(const STACK_OF(SCT) *scts, CT_POLICY_EVAL_CTX *ctx);
sct_validation_status_t SCT_get_validation_status(const SCT *sct);

Like, that enum is right there, memorize it, it's giving vocabulary list energy 📚

---

✨ DESCRIPTION ✨

So SCT_validate() does the whole vibe-check on one SCT — confirms it's valid and verifies its signature. SCT_LIST_validate() is the same thing but for an entire stack of SCTs, because why do one when you can do the whole group chat. 💫

And how do you find out how it went? You pass the SCT to SCT_get_validation_status() and it tells you. Obsessed with the workflow.

For all this to work you must hand over a CT_POLICY_EVAL_CTX that specifies:

• The certificate the SCT was issued for.

Fail to provide it? The validation status comes back as SCT_VALIDATION_STATUS_UNVERIFIED. 😭

• The issuer of that certificate.

This one's only required if the SCT was issued for a pre-certificate (see RFC 6962, iykyk). If it is required but you didn't give it, the validation status is SCT_VALIDATION_STATUS_UNVERIFIED again.

• A CTLOG_STORE that contains the CT log that issued this SCT.

If the SCT came from a log that isn't in this CTLOG_STORE, the validation status is SCT_VALIDATION_STATUS_UNKNOWN_LOG. Not me getting a mystery log 💀

Okay and here's the rest of the status breakdown, because it's literally the whole point:

• If the SCT is an unsupported version (only v1 is currently supported, sorry to the v2 stans), the validation status will be SCT_VALIDATION_STATUS_UNKNOWN_VERSION.
• If the SCT's signature is incorrect, or its timestamp is in the future (relative to the time in CT_POLICY_EVAL_CTX), or if it's otherwise invalid — validation status: SCT_VALIDATION_STATUS_INVALID. 🚩
• If all the checks pass? SCT_VALIDATION_STATUS_VALID. Slay. 👑

---

🦋 NOTES 🦋

Groundbreaking public service announcement: a return value of 0 from SCT_LIST_validate() should not be interpreted as a failure. At a minimum, only one valid SCT may provide sufficient confidence that a certificate has been publicly logged. One icon is enough to carry the whole stack, fr fr. 🫶

---

🎀 RETURN VALUES 🎀

• SCT_validate() — returns a negative integer if an internal error occurs, 0 if the SCT fails validation, or 1 if the SCT passes validation. Three moods, one function.
• SCT_LIST_validate() — returns a negative integer if an internal error occurs, 0 if any of the SCTs fails validation, or 1 if they all pass validation.
• SCT_get_validation_status() — returns the validation status of the SCT. And if SCT_validate() or SCT_LIST_validate() have not been passed that SCT, you get SCT_VALIDATION_STATUS_NOT_SET. Basically the "we've never met" status 🙈

---

🔥 SEE ALSO 🔥

• ct(7) — go read it, bestie, it's the lore

---

🌈 HISTORY 🌈

These functions were added in OpenSSL 1.1.0. So they've been iconic since way back. 👑

---

💜 COPYRIGHT 💜

Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

⭐ That's the whole page, bestie — brought to you by OpenSSL version 3.5.0, dated 2026-09-25, living its best life under the SCT_VALIDATE(3ossl) title. Now go validate something. Periodt. 💅🌈