X509_ADD_CERT(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 X509_ADD_CERT — the certificate-list-adding girlies (3ossl)

Okay so bestie, welcome to 3ossl (that's the manual section, keep up ✨). This is the page for X509_add_cert and X509_add_certs — the two functions that shove certificates into a STACK_OF(X509) list. It's giving "put the cert in the bag" energy and honestly? Iconic. 🎀

✨ SYNOPSIS ✨

#include <openssl/x509.h>

int X509_add_cert(STACK_OF(X509) *sk, X509 *cert, int flags);
int X509_add_certs(STACK_OF(X509) *sk, STACK_OF(X509) *certs, int flags);

🌸 DESCRIPTION 🌸

So X509_add_cert() adds one certificate, cert, to the given list sk. And listen — it is an error for the cert argument to be NULL. Like, genuinely an error. Not a vibe. Do not do that. 🙈

X509_add_certs() adds a whole list of certificates, certs, to the given list sk. The certs argument may be NULL, which just means "no effect" — nothing happens, we move on, slay. This function does not modify the certs list itself, but if the X509_ADD_FLAG_UP_REF flag (more on her below 👇) is set, then the reference counters of those of its members that got added to sk are increased.

Both these functions have a flags parameter, and she's the one controlling the details of the operation. Main character energy fr fr. 🔥

  • The value X509_ADD_FLAG_DEFAULT, which equals 0, means no special semantics. Just the plain vanilla behaviour, no notes.
  • If X509_ADD_FLAG_UP_REF is set then the reference counts of those certificates that were added successfully are increased.
  • If X509_ADD_FLAG_PREPEND is set then the certificates are prepended to sk. By default they are appended to sk. And in both cases the original order of the added certificates is preserved — we are not out here scrambling anyone's order, periodt. 👑
  • If X509_ADD_FLAG_NO_DUP is set then certificates already contained in sk are ignored, and that "already contained" check is determined using X509_cmp(3).
  • If X509_ADD_FLAG_NO_SS is set then certificates that are marked self-signed are ignored, and that determination is made using X509_self_signed(3).

💖 RETURN VALUES 💖

Both functions return 1 for success and 0 for failure. Binary queen. Two moods, no in-between.

⚠️ NOTES ⚠️

If X509_add_certs() is used with the flags X509_ADD_FLAG_NO_DUP or X509_ADD_FLAG_NO_SS, it is advisable to also use X509_ADD_FLAG_UP_REF, because otherwise, likely not for all members of the certs list is the ownership transferred to the list of certificates sk. (Read that sentence twice, bestie, it matters. 💀)

Care should also be taken in case the certs argument equals sk. Like, same list, same object, careful vibes only. 🫶

🦋 SEE ALSO 🦋

X509_cmp(3) · X509_self_signed(3)

🌈 HISTORY 🌈

The functions X509_add_cert() and X509_add_certs() were added in OpenSSL 3.0. So they're not ancient, they're just established. Iykyk. ✨

Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

Signed, sealed, delivered: this was 3.5.0, dated 2026-09-25, and your girl is logging off — go add some certs, bestie, you're gonna eat 💅💜🌸

📦 where this page comes from