X509_GET_SUBJECT_NAME(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 X509_GET_SUBJECT_NAME(3ossl) — like, the whole subject/issuer name situation

Hey bestie 🫶 so this is X509_GET_SUBJECT_NAME(3ossl) — the manual page for grabbing X509_NAME hashes and getting/setting issuer or subject names. It lives in section 3ossl, and honestly? it's giving "quietly essential crypto plumbing" and I'm obsessed. ✨

🌸 NAME

X509_NAME_hash_ex, X509_NAME_hash, X509_get_subject_name, X509_set_subject_name, X509_subject_name_hash, X509_get_issuer_name, X509_set_issuer_name, X509_issuer_name_hash, X509_REQ_get_subject_name, X509_REQ_set_subject_name, X509_ACERT_get0_issuerName, X509_ACERT_set1_issuerName, X509_CRL_get_issuer, X509_CRL_set_issuer_name — get X509_NAME hashes, or get and set issuer or subject names. That's the whole vibe. 💖

✨ SYNOPSIS

#include <openssl/x509.h>

unsigned long X509_NAME_hash_ex(const X509_NAME *x, OSSL_LIB_CTX *libctx,
                                const char *propq, int *ok);

X509_NAME *X509_get_subject_name(const X509 *x);
int X509_set_subject_name(X509 *x, const X509_NAME *name);
unsigned long X509_subject_name_hash(X509 *x);

X509_NAME *X509_get_issuer_name(const X509 *x);
int X509_set_issuer_name(X509 *x, const X509_NAME *name);
unsigned long X509_issuer_name_hash(X509 *x);

X509_NAME *X509_REQ_get_subject_name(const X509_REQ *req);
int X509_REQ_set_subject_name(X509_REQ *req, const X509_NAME *name);

X509_NAME *X509_CRL_get_issuer(const X509_CRL *crl);
int X509_CRL_set_issuer_name(X509_CRL *x, const X509_NAME *name);

#include <openssl/x509_acert.h>

X509_NAME *X509_ACERT_get0_issuerName(const X509_ACERT *x);
int X509_ACERT_set1_issuerName(X509_ACERT *x, const X509_NAME *name);
🚨 Deprecation checkpoint, bestie — the following macro has been deprecated since OpenSSL 3.0, and can be hidden entirely by defining OPENSSL_API_COMPAT with a suitable version value. See openssl_user_macros(7) for the deets.
#define X509_NAME_hash(x) X509_NAME_hash_ex(x, NULL, NULL, NULL)

🦋 DESCRIPTION

Okay so, one by one:

  • X509_NAME_hash_ex() returns a hash value of name x, or 0 on failure — using whatever library context libctx and property query propq you hand it. The ok result argument can be NULL, or else it's used to return 1 for success and 0 for failure. Failing can happen on a malloc error, or if there's no SHA1 implementation available. 😭
  • X509_NAME_hash() returns a hash value of name x or 0 on failure, using the default library context and the default property query. Simple. Chill. 🧚
  • X509_get_subject_name() returns the subject name of certificate x. The value you get back is an internal pointer which MUST NOT be freed — do not touch, do not free, do not pass go. Also x MUST NOT be NULL. Ngl that's the whole rule. 💀
  • X509_set_subject_name() sets the issuer name of certificate x to name. (Yep, that's exactly what it says, I'm just the messenger 🙈.) The name parameter is copied internally, so you should free it up when it's no longer needed.
  • X509_subject_name_hash() returns a hash value of the subject name of certificate x.
  • X509_get_issuer_name(), X509_set_issuer_name(), and X509_issuer_name_hash() are identical to X509_get_subject_name(), X509_set_subject_name(), and X509_subject_name_hash() — except they relate to the issuer name of x. Same energy, different name. 👑
  • Similarly, X509_REQ_get_subject_name(), X509_REQ_set_subject_name(), X509_ACERT_get0_issuerName(), X509_ACERT_set1_issuerName(), X509_CRL_get_issuer() and X509_CRL_set_issuer_name() get or set the subject or issuer names of certificate requests or CRLs respectively.
  • Special note for attribute certificates: since they don't have a subject name, only the issuer name can be set. For details on setting X509_ACERT holder identities, see X509_ACERT_set0_holder_entityName(3). 🌈

🎀 RETURN VALUES

X509_get_subject_name(), X509_get_issuer_name(), X509_REQ_get_subject_name(), X509_ACERT_get0_issuerName() and X509_CRL_get_issuer() return an X509_NAME pointer. Slay. 💅

X509_NAME_hash_ex(), X509_NAME_hash(), X509_subject_name_hash() and X509_issuer_name_hash() return the first four bytes of the SHA1 hash value, converted to unsigned long in little endian order — or 0 on failure. Literally just four bytes. Iconic.

X509_set_subject_name(), X509_set_issuer_name(), X509_REQ_set_subject_name(), X509_ACERT_get0_issuerName() and X509_CRL_set_issuer_name() return 1 for success and 0 for failure.

💀 BUGS

Bestie, listen: if X509_NAME_hash(), X509_subject_name_hash(), or X509_issuer_name_hash() returns 0, it remains unclear whether that's the real hash value or a failure. Genuinely ambiguous. 😭 Better use X509_NAME_hash_ex() instead — fr fr, do that.

🔥 SEE ALSO

d2i_X509(3), ERR_get_error(3), d2i_X509(3) X509_CRL_get0_by_serial(3), X509_get0_signature(3), X509_get_ext_d2i(3), X509_get_extension_flags(3), X509_get_pubkey(3), X509_NAME_add_entry_by_txt(3), X509_NAME_ENTRY_get_object(3), X509_NAME_get_index_by_NID(3), X509_NAME_print_ex(3), X509_new(3), X509_sign(3), X509V3_get_d2i(3), X509_verify_cert(3)

⭐ HISTORY

  • X509_REQ_get_subject_name() is a function in OpenSSL 1.1.0 and a macro in earlier versions. Glow-up. ✨
  • X509_CRL_get_issuer() is a function in OpenSSL 1.1.0. It was previously added in OpenSSL 1.0.0 as a macro.
  • X509_NAME_hash() was turned into a macro and deprecated in OpenSSL 3.0. 🫠
  • X509_ACERT_get0_issuerName(), X509_ACERT_set1_issuerName() were added in OpenSSL 3.4. New arrivals, welcome them. 🎀

Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

Okay that's the whole page, bestie — you ate that 💖 This little beauty is from version 3.5.0, dated 2026-09-25, so go forth and hash responsibly. Mwah! 🦋

📦 where this page comes from