X509_NAME_PRINT_EX(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 X509_NAME_PRINT_EX (3ossl) — okay so this is the OpenSSL manual page for the X509_NAME printing routines

Bestie, welcome to the little corner of OpenSSL that's literally just about making an X509 name look cute when you print it. Three separate eras of code live here and two of them are… giving legacy 🙈, so let's get into it.

#include <openssl/x509.h>

int X509_NAME_print_ex(BIO *out, const X509_NAME *nm,
                       int indent, unsigned long flags);
int X509_NAME_print_ex_fp(FILE *fp, const X509_NAME *nm,
                          int indent, unsigned long flags);
char *X509_NAME_oneline(const X509_NAME *a, char *buf, int size);
int X509_NAME_print(BIO *bp, const X509_NAME *name, int obase);

🎀 NAME 🎀

X509_NAME_print_ex, X509_NAME_print_ex_fp, X509_NAME_print, X509_NAME_oneline — the X509_NAME printing routines, aka the whole friend group.

🌸 SYNOPSIS 🌸

Yeah so all four of them live under #include <openssl/x509.h>, and here's the lineup:

int X509_NAME_print_ex(BIO *out, const X509_NAME *nm,
                       int indent, unsigned long flags);
int X509_NAME_print_ex_fp(FILE *fp, const X509_NAME *nm,
                          int indent, unsigned long flags);
char *X509_NAME_oneline(const X509_NAME *a, char *buf, int size);
int X509_NAME_print(BIO *bp, const X509_NAME *name, int obase);

✨ DESCRIPTION ✨

  • X509_NAME_print_ex() — prints a human readable version of nm to the BIO out. Every line (well, for the multiline formats) gets indented by indent spaces. And the output format? Extensively customizable via the flags parameter. She's flexible, she's iconic, she's the main character of this page.
  • X509_NAME_print_ex_fp() — literally identical to X509_NAME_print_ex() except the output goes to the FILE pointer fp instead. Same energy, different destination. 🫶
  • X509_NAME_oneline() — prints an ASCII version of a to buf. This one supports multi-valued RDNs and escapes / and + characters in values. If buf is NULL then a buffer is dynamically allocated and returned, and size is ignored (slay, she handles it for you). Otherwise, at most size bytes will be written, including the ending '\0', and buf is returned.
  • X509_NAME_print() — prints out name to bp, indenting each line by obase characters. Multiple lines get used if the output (including the indent) exceeds 80 characters. Old school.

🦋 NOTES 🦋

Okay so real talk, bestie: X509_NAME_oneline() and X509_NAME_print() produce a non standard output form, they don't handle multi-character fields, and they have various quirks and inconsistencies. Their use is strongly discouraged in new applications and they could be deprecated in a future release. 💀 Not me telling you to avoid them, but like… avoid them. Ngl.

Although there are a large number of possible flags for most purposes XN_FLAG_ONELINE, XN_FLAG_MULTILINE or XN_FLAG_RFC2253 will suffice. As noted on the ASN1_STRING_print_ex(3) manual page, for UTF8 terminals the ASN1_STRFLGS_ESC_MSB should be unset: so for example XN_FLAG_ONELINE & ~ASN1_STRFLGS_ESC_MSB would be used. Little bit of flag math, iykyk.

The complete set of the flags supported by X509_NAME_print_ex() is listed below. Several options can be ored together. 🧚

💜 The separator girlies

The options XN_FLAG_SEP_COMMA_PLUS, XN_FLAG_SEP_CPLUS_SPC, XN_FLAG_SEP_SPLUS_SPC and XN_FLAG_SEP_MULTILINE determine the field separators to use. Two distinct separators are used between distinct RelativeDistinguishedName components and separate values in the same RDN for a multi-valued RDN. Multi-valued RDNs are currently very rare so the second separator will hardly ever be used — she's prepared, but like, nobody's texting her.

  • XN_FLAG_SEP_COMMA_PLUS uses comma and plus as separators.
  • XN_FLAG_SEP_CPLUS_SPC uses comma and plus with spaces: this is more readable that plain comma and plus (yes, that's the original wording, I'm not fixing it, it's canon 💅).
  • XN_FLAG_SEP_SPLUS_SPC uses spaced semicolon and plus.
  • XN_FLAG_SEP_MULTILINE uses spaced newline and plus respectively.

🌈 The rest of the flags

  • If XN_FLAG_DN_REV is set the whole DN is printed in reversed order. Flip it and reverse it. 🔥
  • The fields XN_FLAG_FN_SN, XN_FLAG_FN_LN, XN_FLAG_FN_OID, XN_FLAG_FN_NONE determine how a field name is displayed. It will use the short name (e.g. CN), the long name (e.g. commonName), always use OID numerical form (normally OIDs are only used if the field name is not recognised), and no field name respectively.
  • If XN_FLAG_SPC_EQ is set then spaces will be placed around the '=' character separating field names and values. Breathing room, bestie. 🍓
  • If XN_FLAG_DUMP_UNKNOWN_FIELDS is set then the encoding of unknown fields is printed instead of the values.
  • If XN_FLAG_FN_ALIGN is set then field names are padded to 20 characters: this is only of use for multiline format. Alignment is self care ✨

Additionally all the options supported by ASN1_STRING_print_ex() can be used to control how each field value is displayed.

🎀 The preset format flags (the ones you'll actually use)

In addition a number options can be set for commonly used formats.

  • XN_FLAG_RFC2253 sets options which produce an output compatible with RFC2253. It is equivalent to:
"ASN1_STRFLGS_RFC2253 | XN_FLAG_SEP_COMMA_PLUS | XN_FLAG_DN_REV
  | XN_FLAG_FN_SN | XN_FLAG_DUMP_UNKNOWN_FIELDS"
  • XN_FLAG_ONELINE is a more readable one line format which is the same as:
"ASN1_STRFLGS_RFC2253 | ASN1_STRFLGS_ESC_QUOTE | XN_FLAG_SEP_CPLUS_SPC
  | XN_FLAG_SPC_EQ | XN_FLAG_FN_SN"
  • XN_FLAG_MULTILINE is a multiline format which is the same as:
"ASN1_STRFLGS_ESC_CTRL | ASN1_STRFLGS_ESC_MSB | XN_FLAG_SEP_MULTILINE
  | XN_FLAG_SPC_EQ | XN_FLAG_FN_LN | XN_FLAG_FN_ALIGN"
  • XN_FLAG_COMPAT uses a format identical to X509_NAME_print(): in fact it calls X509_NAME_print() internally. She's not even original, she's just a wrapper 😭

🫶 RETURN VALUES 🫶

  • X509_NAME_oneline() returns a valid string on success or NULL on error.
  • X509_NAME_print() returns 1 on success or 0 on error.
  • X509_NAME_print_ex() and X509_NAME_print_ex_fp() return 1 on success or 0 on error if the XN_FLAG_COMPAT is set, which is the same as X509_NAME_print(). Otherwise, it returns -1 on error or other values on success.
Okay yes, the return value situation is a little unhinged — 1/0 in compat mode, -1/whatever otherwise. Check your flags before you check your returns, bestie. ⭐

💖 SEE ALSO 💖

Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

And that's the page, babe — this was OpenSSL 3.5.0, dated 2026-09-25, brought to you by the X509_NAME_PRINT_EX(3ossl) girlies. Go print some names, stay off X509_NAME_oneline() unless you have to, and hydrate 💅✨

📦 where this page comes from