X509_CHECK_CA(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

🌸 NAME

hiii bestie 💖 welcome to the X509_CHECK_CA(3ossl) page — manual name 3ossl, OpenSSL girlies rise. This page is all about one little function doing a CA vibe check.

X509_check_ca — check if given certificate is CA certificate.

✨ SYNOPSIS

#include <openssl/x509v3.h>

int X509_check_ca(X509 *cert);

💅 DESCRIPTION

okay so X509_check_ca() checks if the given certificate is a CA certificate — you know, the kind that can be used to sign other certificates. It's giving "are you the main character who signs the other certs?" energy. 👑

The certificate must be a complete certificate otherwise an error is returned. No incomplete-cert chaos allowed, bestie. 🚫

🎀 RETURN VALUES

Here's the return-value tea, and yes you need every number:

  • 0 — not a CA certificate.
  • 1 — proper X509v3 CA certificate with basicConstraints extension CA:TRUE.
  • 3 — self-signed X509 v1 certificate.
  • 4 — certificate with keyUsage extension with bit keyCertSign set, but without basicConstraints.
  • 5 — has outdated Netscape Certificate Type extension telling that it is CA certificate.

This function will also return 0 on error. So 0 is doing double duty: "not a CA" and "oops, error." 😭

Actually, any nonzero value means that this certificate could have been used to sign other certificates. So nonzero = potentially signer-cert material, periodt. ✨

🦋 SEE ALSO

go read these next, bestie 🫶

Legal bestie moment, keep it exact:

Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

This iconic page is from OpenSSL 3.5.0, dated 2026-09-25 — slay, bye 💅✨

📦 where this page comes from