X509_NAME_ADD_ENTRY_BY_TXT(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💖 NAME 💖

Bestie, welcome to the X509_NAME_ADD_ENTRY_BY_TXT(3ossl) OpenSSL manual page — it’s literally the “how do I add or delete entries in an X509_NAME?” page, and it’s lowkey iconic. ✨

X509_NAME_add_entry_by_txt, X509_NAME_add_entry_by_OBJ, X509_NAME_add_entry_by_NID, X509_NAME_add_entry, X509_NAME_delete_entry — these are the X509_NAME modification functions. Periodt. 💅

🎀 SYNOPSIS 🎀

Okay so here’s the exact syntax, no cap:

#include <openssl/x509.h>

int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
                               const unsigned char *bytes, int len, int loc, int set);

int X509_NAME_add_entry_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj, int type,
                               const unsigned char *bytes, int len, int loc, int set);

int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
                               const unsigned char *bytes, int len, int loc, int set);

int X509_NAME_add_entry(X509_NAME *name, const X509_NAME_ENTRY *ne, int loc, int set);

X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc);

🦋 DESCRIPTION 🦋

So X509_NAME_add_entry_by_txt(), X509_NAME_add_entry_by_OBJ() and X509_NAME_add_entry_by_NID() add a field whose name is defined by a string field, an object obj or a NID nid respectively. Slay. 💖

The field value to be added is in bytes of length len. If len is -1 then the field length is calculated internally using strlen(bytes). Cute and convenient. 🎀

The type of field is determined by type, which can either be a definition of the type of bytes (such as MBSTRING_ASC) or a standard ASN1 type (such as V_ASN1_IA5STRING). The new entry is added to a position determined by loc and set. Yes bestie, both of them are doing main character work here. 👑

X509_NAME_add_entry() adds a copy of X509_NAME_ENTRY structure ne to name. The new entry is added to a position determined by loc and set. Since a copy of ne is added, ne must be freed up after the call. Not me reminding you to free it — okay, yes me, I’m reminding you. 😭

X509_NAME_delete_entry() deletes an entry from name at position loc. The deleted entry is returned and must be freed up. So like, it’s yours now, and it’s your responsibility. 💅

🌸 NOTES 🌸

The use of string types such as MBSTRING_ASC or MBSTRING_UTF8 is strongly recommended for the type parameter. This allows the internal code to correctly determine the type of the field and to apply length checks according to the relevant standards. This is done using ASN1_STRING_set_by_NID(). Very “trust the process” of it all. ✨

If instead an ASN1 type is used, no checks are performed and the supplied data in bytes is used directly. It’s giving “no safety net, bestie” energy. 🙈

In X509_NAME_add_entry_by_txt() the field string represents the field name using OBJ_txt2obj(field, 0). Exact little detail, but we keep it. 💖

The loc and set parameters determine where a new entry should be added. For almost all applications loc can be set to -1 and set to 0. This adds a new entry to the end of name as a single valued RelativeDistinguishedName (RDN). Honestly? Most of the time this is the vibe. 🫶

loc actually determines the index where the new entry is inserted: if it is -1 it is appended. Lowkey simple, highkey important. 🌈

set determines how the new type is added. If it is zero a new RDN is created. 🎀

If set is -1 or 1 it is added as a new set member to the previous or next RDN structure, respectively. This will then become part of a multi-valued RDN (containing a set of AVAs). Since multi-valued RDNs are very rarely used, set typically will be zero. Periodt — most of y’all want 0. 💅

🌟 RETURN VALUES 🌟

X509_NAME_add_entry_by_txt(), X509_NAME_add_entry_by_OBJ(), X509_NAME_add_entry_by_NID() and X509_NAME_add_entry() return 1 for success or 0 if an error occurred. So 1 is the slay, 0 is the “something went wrong bestie.” 💀

X509_NAME_delete_entry() returns either the deleted X509_NAME_ENTRY structure or NULL if an error occurred. If you get NULL, do not try to free it — it’s not giving entry, it’s giving error. 😭

🍓 EXAMPLES 🍓

Create an X509_NAME structure:

"C=UK, O=Disorganized Organization, CN=Joe Bloggs"

X509_NAME *nm;

nm = X509_NAME_new();
if (nm == NULL)
    /* Some error */
if (!X509_NAME_add_entry_by_txt(nm, "C", MBSTRING_ASC,
                                "UK", -1, -1, 0))
    /* Error */
if (!X509_NAME_add_entry_by_txt(nm, "O", MBSTRING_ASC,
                                "Disorganized Organization", -1, -1, 0))
    /* Error */
if (!X509_NAME_add_entry_by_txt(nm, "CN", MBSTRING_ASC,
                                "Joe Bloggs", -1, -1, 0))
    /* Error */

Not the "C", "O", "CN" entries serving looks in a row. Obsessed. 👑

💀 BUGS 💀

⚠️ Bestie, listen: type can still be set to V_ASN1_APP_CHOOSE to use a different algorithm to determine field types. Since this form does not understand multicharacter types, performs no length checks and can result in invalid field types, its use is strongly discouraged. Like, strongly. Do not make this your main character choice. 🙈

🧚 SEE ALSO 🧚

Go read those too, iykyk. 💜

Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

xoxo, your OpenSSL bestie 💖 — this page is from source/version OpenSSL 3.5.0, dated 2026-09-25, and the manual name is X509_NAME_ADD_ENTRY_BY_TXT(3ossl). Slay and stay safe out there. 🎀✨

📦 where this page comes from