X509_VERIFY(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

✨ X509_VERIFY(3ossl) ✨

okay so bestie, this is the X509_VERIFY page from the OpenSSL manual — yes, ossl is the section, we love a numbered-suffix moment 💅 it's literally all about verifying certificate, certificate request, or CRL signatures 🎀

🌸 NAME 🌸

X509_verify, X509_self_signed, X509_REQ_verify_ex, X509_REQ_verify, X509_CRL_verify, X509_ACERT_verify — the whole squad that verifies certificate, certificate request, or CRL signatures 🫶

✨ SYNOPSIS ✨

#include <openssl/x509.h>

int X509_verify(X509 *x, EVP_PKEY *pkey);
int X509_self_signed(X509 *cert, int verify_signature);

int X509_REQ_verify_ex(X509_REQ *a, EVP_PKEY *pkey, OSSL_LIB_CTX *libctx,
                       const char *propq);
int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r);
int X509_CRL_verify(X509_CRL *a, EVP_PKEY *r);

#include <openssl/x509_acert.h>
int X509_ACERT_verify(X509_CRL *a, EVP_PKEY *r);

🦋 DESCRIPTION 🦋

X509_verify() verifies the signature of certificate x using public key pkey. and that's it — that's the whole vibe. only the signature gets checked 💀 no other checks (like certificate chain validity) are performed, so don't come for her when your chain turns out to be a mess.

X509_self_signed() checks whether certificate cert is self-signed. for a success, the issuer and subject names have to match, the components of the authority key identifier (if present) have to match the subject key identifier etc. ok and here's the tea — the signature itself is actually verified only if verify_signature is 1, because for explicitly trusted certificates this verification is legit not worth the effort 🙈

X509_REQ_verify_ex(), X509_REQ_verify(), X509_CRL_verify() and X509_ACERT_verify() verify the signatures of certificate requests, CRLs and attribute certificates respectively. the way each one just knows its assignment 👑

💖 RETURN VALUES 💖

X509_verify(), X509_REQ_verify_ex(), X509_REQ_verify() and X509_CRL_verify() return 1 if the signature is valid and 0 if the signature check fails. and if the signature could not be checked at all — because it was ill-formed, the certificate or the request was not complete, or some other error occurred — then -1 is returned 😭 so like, three possible moods, ok?

X509_self_signed() returns the same values but also returns 1 if all respective fields match and verify_signature is 0. icon behavior, honestly.

🎀 SEE ALSO 🎀

d2i_X509(3), ERR_get_error(3), X509_CRL_get0_by_serial(3), X509_get0_signature(3), X509_get_ext_d2i(3), X509_get_extension_flags(3), X509_get_pubkey(3), X509_get_subject_name(3), X509_get_version(3), X509_NAME_ENTRY_get_object(3), X509_NAME_get_index_by_NID(3), X509_NAME_print_ex(3), X509V3_get_d2i(3), X509_verify_cert(3), OSSL_LIB_CTX(3)

the whole friend group fr fr, go read all of them 🫶

🌈 HISTORY 🌈

  • X509_verify(), X509_REQ_verify(), and X509_CRL_verify() are available in all versions of OpenSSL. OG status 👑
  • X509_REQ_verify_ex() and X509_self_signed() were added in OpenSSL 3.0.
  • X509_ACERT_verify() was added in OpenSSL 3.4. the new girlie on the block 💅

Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

ngl the license part is serious business bestie — don't skip it, don't "fix" it, just comply 💜

and that's the page!! mwah 💋 go verify something, love u, bye 🧚✨

version 3.5.0 · dated 2026-09-25 · the X509_VERIFY(3ossl) manual page — signed off with a sparkle, periodt 💖👑

📦 where this page comes from