X509_GET0_DISTINGUISHING_ID(3ossl)

💅 X509_get0_distinguishing_id — OpenSSL 3ossl, bestie edition

okay so this is one of those manpages from the OpenSSL crew (manual section 3ossl) and honestly it's short but it's important, so grab a snack 🍓 and let's get into it.

---

✨ NAME ✨

X509_get0_distinguishing_id, X509_set0_distinguishing_id, X509_REQ_get0_distinguishing_id, X509_REQ_set0_distinguishing_id — the getters and setters for the Distinguishing ID used in certificate operations 🎀

---

🌸 SYNOPSIS 🌸

#include <openssl/x509.h>

ASN1_OCTET_STRING *X509_get0_distinguishing_id(X509 *x);
void X509_set0_distinguishing_id(X509 *x, ASN1_OCTET_STRING *distid);
ASN1_OCTET_STRING *X509_REQ_get0_distinguishing_id(X509_REQ *x);
void X509_REQ_set0_distinguishing_id(X509_REQ *x, ASN1_OCTET_STRING *distid);

bestie, that's literally it. four functions. two getters, two setters. we love a tidy API 🫶

---

🦋 DESCRIPTION 🦋

so the Distinguishing ID is defined in FIPS 196 like this, and I'm quoting it verbatim because it's giving very official:

Distinguishing identifier Information which unambiguously distinguishes an entity in the authentication process.

okay so what does that mean for you? The SM2 signature algorithm requires a Distinguishing ID value when generating and verifying a signature 🔥 — but the Distinguishing ID may also find other uses. In the context of SM2, the Distinguishing ID is often referred to as the "SM2 ID". that's the name you'll hear in the wild, iykyk.

and here's where it gets cute: for the purpose of verifying a certificate or a certification request, a Distinguishing ID may be attached to it, so functions like X509_verify(3) or X509_REQ_verify(3) have easy access to that identity for signature verification. it's giving "your ID but embedded, so verification can just find it" 💅

the getters, one by one 💖

• X509_get0_distinguishing_id() — gets the Distinguishing ID value of a certificate x by returning an ASN1_OCTET_STRING object. ⚠️ that object should not be freed by the caller. the 0 in the name is the tell — it's a borrowed reference, not yours to yeet.
• X509_set0_distinguishing_id() — assigns distid to the certificate x. calling this function transfers the memory management of the value to the X509 object, and therefore the value that has been passed in should not be freed by the caller after this function has been called. 👑 ownership handoff, periodt.
• X509_REQ_get0_distinguishing_id() and X509_REQ_set0_distinguishing_id() — same functionality as X509_get0_distinguishing_id() and X509_set0_distinguishing_id(), except that they deal with X509_REQ objects instead of X509. same vibe, different struct 🧚

🫶 friendly reminder: get0 = you don't free it. set0 = you don't free it after, the object owns it now. get this wrong and it's a double-free situation and nobody wants that 😭

---

⭐ RETURN VALUES ⭐

X509_set0_distinguishing_id() and X509_REQ_set0_distinguishing_id() do not return a value. that's it, that's the whole section. they're void and they're at peace with it 💀

---

🌈 SEE ALSO 🌈

• X509_verify(3)
• SM2(7)

---

👑 COPYRIGHT 👑

Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the page, bestie! 🌸 this one's from OpenSSL 3.5.0, dated 2026-09-25, and the manual name on the tin is X509_GET0_DISTINGUISHING_ID(3ossl). go forth and identify yourself unambiguously ✨💜