X509_SIGN(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 X509_SIGN — sign certificate, certificate request, or CRL signature ✨

okay bestie, welcome to X509_SIGN(3ossl) 💖 this is one of those pages from the OpenSSL manual set, and it's honestly kind of the main character of the whole cert pipeline. let's get into it 🎀

✨ NAME ✨

X509_sign, X509_sign_ctx, X509_REQ_sign, X509_REQ_sign_ctx, X509_ACERT_sign, X509_ACERT_sign_ctx, X509_CRL_sign, X509_CRL_sign_ctx — sign certificate, certificate request, or CRL signature. that's the whole vibe. you make the little cryptographic signature that says "yes, this is really me" 👑

🦋 SYNOPSIS 🦋

#include <openssl/x509.h>

int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx);

int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md);
int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx);

int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md);
int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx);

#include <openssl/x509_acert.h>

int X509_ACERT_sign(X509_ACERT *x, EVP_PKEY *pkey, const EVP_MD *md);
int X509_ACERT_sign_ctx(X509_ACERT *x, EVP_MD_CTX *ctx);

notice how the attribute certificate girlies need their own lil header — x509_acert.h — she's separate 💅

🌸 DESCRIPTION 🌸

so X509_sign() signs certificate x using private key pkey and message digest md, and sets the signature in x. that's it, that's the whole thing, no cap 🫶

X509_sign_ctx() also signs certificate x, but it uses the parameters contained in digest context ctx instead of you handing over a key and a digest separately.

and here's a cute lil detail that matters: if the certificate information includes X.509 extensions, these two functions make sure that the certificate bears X.509 version 3 ✨ she just knows.

then we have the rest of the squad — X509_REQ_sign(), X509_REQ_sign_ctx(), X509_ACERT_sign(), X509_ACERT_sign_ctx(), X509_CRL_sign(), and X509_CRL_sign_ctx() — and they sign certificate requests and CRLs, respectively. same energy, different struct 😌

🔥 NOTES 🔥

X509_sign_ctx() is the one you reach for when the default parameters for the corresponding public key and digest just aren't it. it can be used to sign keys using RSA-PSS for example. so if you're like "bestie the defaults don't fit my situation", this is your girl 💁‍♀️

now for the slightly cursed part, and I need you to pay attention:

for efficiency reasons and to work around ASN.1 encoding issues, the encoding of the signed portion of a certificate, certificate request and CRL is cached internally. so if the signed portion of the structure is modified, the encoding is not always updated — meaning a stale version is sometimes used 😭

not normally a problem though! because modifying the signed portion will invalidate the signature anyway, and signing will always update the encoding. so like, the cache can be stale but the signature is already cooked, ykwim? still, know it, don't get got 💀

💜 RETURN VALUES 💜

all of these functions return the size of the signature in bytes for success, and zero for failure. so if you get 0, that's a fail, go check your errors 🧚

🌈 SEE ALSO 🌈

ERR_get_error(3), X509_NAME_add_entry_by_txt(3), X509_new(3), X509_verify_cert(3), X509_verify(3), X509_REQ_verify_ex(3), X509_REQ_verify(3), X509_CRL_verify(3)

like, obviously go read the verify side too, it's giving "sign then verify" and honestly that's the whole relationship 💖

⭐ HISTORY ⭐

  • X509_sign(), X509_REQ_sign() and X509_CRL_sign() — available in all versions of OpenSSL. the OGs. no notes 👑
  • X509_sign_ctx(), X509_REQ_sign_ctx() and X509_CRL_sign_ctx() — added in OpenSSL 1.0.1.
  • X509_ACERT_sign() and X509_ACERT_sign_ctx() — added in OpenSSL 3.4. the new girls on the block 🦋

Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

fr fr read the license, it's not optional bestie 🙈

okay that's the whole page, you ate that 💅 this was X509_SIGN(3ossl), version 3.5.0, dated 2026-09-25 — mwah, go sign something iconic ✨🍓

📦 where this page comes from