SSL_GET_PEER_CERT_CHAIN(3ossl)

okay so bestie, welcome to the SSL_GET_PEER_CERT_CHAIN(3ossl) page — yes that's the manual name, and yes this whole thing is giving cryptography main character energy 🔥. It's literally all about grabbing the X509 certificate chain of the peer, no cap.

✨ NAME ✨

SSL_get_peer_cert_chain, SSL_get0_verified_chain — get the X509 certificate chain of the peer. That's the whole vibe check: peer cert chain, get it 💅.

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *ssl);
STACK_OF(X509) *SSL_get0_verified_chain(const SSL *ssl);

💖 DESCRIPTION 💖

SSL_get_peer_cert_chain() returns a pointer to STACK_OF(X509) certificates forming the certificate chain sent by the peer. If you call it on the client side, the stack also contains the peer's certificate; if you call it on the server side, the peer's certificate has to be obtained separately using SSL_get_peer_certificate(3). And if the peer did not present a certificate, NULL is returned — not me getting a null result and acting surprised 😭.

NB: SSL_get_peer_cert_chain() returns the peer chain as sent by the peer: it only consists of certificates the peer has sent (in the order the peer has sent them) — it is not a verified chain. periodt.

SSL_get0_verified_chain() returns the verified certificate chain of the peer including the peer's end entity certificate. It must be called after a session has been successfully established. If peer verification was not successful (as indicated by SSL_get_verify_result() not returning X509_V_OK) the chain may be incomplete or invalid. so like, check the vibe before you trust it 🫶.

🦋 NOTES 🦋

If the session is resumed, peers do not send certificates, so a NULL pointer is returned by these functions. Applications can call SSL_session_reused() to determine whether a session is resumed. lowkey important, bestie.

The reference count of each certificate in the returned STACK_OF(X509) object is not incremented, and the returned stack may be invalidated by renegotiation. If applications wish to use any certificates in the returned chain indefinitely, they must increase the reference counts using X509_up_ref() or obtain a copy of the whole chain with X509_chain_up_ref(). like, if you want to keep it, you gotta secure the bag yourself 💀.

🎀 RETURN VALUES 🎀

The following return values can occur:

• NULL — No certificate was presented by the peer or no connection was established or the certificate chain is no longer available when a session is reused. the iconic empty-handed moment 🙈.
• Pointer to a STACK_OF(X509) — The return value points to the certificate chain presented by the peer. slay, there it is ✨.

👑 SEE ALSO 👑

check out ssl(7), SSL_get_peer_certificate(3), X509_up_ref(3), and X509_chain_up_ref(3) — the whole group chat is linked up 💜.

💜 COPYRIGHT 💜

Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

mwah 💋 this page is from OpenSSL 3.5.0, dated 2026-09-25, and its footer tag is SSL_GET_PEER_CERT_CHAIN(3ossl). byeee 🫶