X509_GET_VERSION(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 X509_GET_VERSION — ok so this is the whole version-field situation

bestie, welcome to the 3ossl girlies' corner of the manual 🎀 this page is your one-stop shop for getting and setting the version field on certificates, certificate requests, and CRLs.

Here's the full cast of characters, because there are a lot of them:

  • X509_get_version, X509_set_version
  • X509_REQ_get_version, X509_REQ_set_version
  • X509_ACERT_get_version, X509_ACERT_set_version
  • X509_CRL_get_version, X509_CRL_set_version

All of them do exactly what the name says: get or set the version on a certificate, a certificate request, or a CRL ✨

✨ SYNOPSIS ✨

First, you gotta pull in the header for the cert/req/CRL girlies:

#include <openssl/x509.h>

long X509_get_version(const X509 *x);
int X509_set_version(X509 *x, long version);

long X509_REQ_get_version(const X509_REQ *req);
int X509_REQ_set_version(X509_REQ *x, long version);

long X509_CRL_get_version(const X509_CRL *crl);
int X509_CRL_set_version(X509_CRL *x, long version);

And the ACERT ones live in their own header, no cap:

#include <openssl/x509_acert.h>

int X509_ACERT_set_version(X509_ACERT *x, long version);
long X509_ACERT_get_version(const X509_ACERT *x);

🦋 DESCRIPTION 🦋

X509_get_version() returns the numerical value of the version field of certificate x. and yes, these correspond to the constants X509_VERSION_1, X509_VERSION_2, and X509_VERSION_3.

⚠️ okay this is the part everyone trips on: the values of these constants are defined by standards (X.509 et al) to be one less than the certificate version. So X509_VERSION_3 has value 2 and X509_VERSION_1 has value 0. it's giving off-by-one but make it ✨standards-compliant✨

X509_set_version() sets the numerical value of the version field of certificate x to version.

Similarly, X509_REQ_get_version(), X509_REQ_set_version(), X509_ACERT_get_version(), X509_ACERT_set_version(), X509_CRL_get_version() and X509_CRL_set_version() get and set the version number of certificate requests and CRLs 💖 They use constants X509_REQ_VERSION_1, X509_ACERT_VERSION_2, X509_CRL_VERSION_1, and X509_CRL_VERSION_2.

🎀 NOTES 🎀

The version field of certificates, certificate requests and CRLs has a DEFAULT value of v1(0) meaning the field should be omitted for version 1. This is handled transparently by these functions — so you don't gotta do anything, the functions are the main characters here and they've got it 🫶

🌸 RETURN VALUES 🌸

  • X509_get_version(), X509_REQ_get_version() and X509_CRL_get_version() return the numerical value of the version field.
  • X509_set_version(), X509_REQ_set_version() and X509_CRL_set_version() return 1 for success and 0 for failure.

🔥 SEE ALSO 🔥

Like, go read these too, iykyk:

👑 HISTORY 👑

X509_get_version(), X509_REQ_get_version() and X509_CRL_get_version() are functions in OpenSSL 1.1.0 — in previous versions they were macros. glow-up fr fr 💅

X509_ACERT_get_version(), X509_ACERT_set_version() were added in OpenSSL 3.4. new drop, fresh off the shelf 🍓

Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, bestie — go forth and version responsibly 🌈✨

version 3.5.0, dated 2026-09-25 — this was X509_GET_VERSION(3ossl), and honestly? she ate 💖🦋
📦 where this page comes from