X509_CHECK_ISSUED(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

okay so welcome to the OpenSSL manual page for X509_CHECK_ISSUED(3ossl), bestie 🫶 this one is all about checking whether a certificate looks like it was issued by another certificate — it's giving trust-chain detective energy, but with a very important "we do not check the signature here" caveat later, okurrr 💅

💖 NAME 💖

X509_check_issued — checks if certificate is apparently issued by another certificate. That's the whole assignment, and she understood it ✨

🦋 SYNOPSIS 🦋

Here's the include and the function signature, exactly as the universe intended:

#include <openssl/x509v3.h>

int X509_check_issued(X509 *issuer, X509 *subject);

✨ DESCRIPTION ✨

okay so X509_check_issued() checks if certificate subject was apparently issued using (CA) certificate issuer. And no, it's not just a lil name match — it takes into account not only matching of the issuer field of subject with the subject field of issuer, but also compares all sub-fields of the authorityKeyIdentifier extension of subject, as far as present, with the respective subjectKeyIdentifier, serial number, and issuer fields of issuer, as far as present. It also checks if the keyUsage field (if present) of issuer allows certificate signing.

🚨 important bestie note: it does not actually check the certificate signature. So do not use this as your whole "omg is this cert valid" arc — it is not doing allat 😭

An error is returned if the issuer or the subject are incomplete certificates. Incomplete certs are not invited to the function party, periodt 💀

🎀 RETURN VALUES 🎀

X509_check_issued() returns X509_V_OK if all checks are successful or some X509_V_ERR* constant to indicate an error. So it's either good vibes with X509_V_OK, or an error constant when things are not slaying 🫶

🌈 SEE ALSO 🌈

go read these next, bestie:

the legal bits, bestie — keep them exactly as-is:

Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License").  You may not use
this file except in compliance with the License.  You can obtain a copy
in the file LICENSE in the source distribution or at
<https://www.openssl.org/source/license.html>.

okay bye bestie — this OpenSSL page is version 3.5.0, dated 2026-09-25, and it's giving X509_CHECK_ISSUED(3ossl) energy 💅✨

📦 where this page comes from