X509_CMP(3ossl)

💅 X509_CMP — comparing certificates and their lil friends

okay so bestie, this is the OpenSSL page for X509_CMP, and it's basically the "are these two things the same tho?" suite for X509 certs, CRLs, and the values inside them. seven functions, one job: compare. let's get into it ✨

---

🌸 NAME

X509_cmp, X509_NAME_cmp, X509_issuer_and_serial_cmp, X509_issuer_name_cmp, X509_subject_name_cmp, X509_CRL_cmp, X509_CRL_match — compare X509 certificates and related values 🫶

---

✨ SYNOPSIS

#include <openssl/x509.h>

int X509_cmp(const X509 *a, const X509 *b);
int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b);
int X509_issuer_and_serial_cmp(const X509 *a, const X509 *b);
int X509_issuer_name_cmp(const X509 *a, const X509 *b);
int X509_subject_name_cmp(const X509 *a, const X509 *b);
int X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b);
int X509_CRL_match(const X509_CRL *a, const X509_CRL *b);

---

🦋 DESCRIPTION

so this whole little squad of functions is for comparing X509 objects — and "objects" here means X509 certificates, X509 CRL objects, and all the various values living inside an X509 certificate. it's giving "compare and contrast" essay energy, but make it crypto 💖

X509_cmp() compares two X509 objects, the ones you passed as a and b. the comparison is based on the memcmp result of the hash values of the two X509 objects, plus the canonical (DER) encoding values. so it's not just vibing off one thing — it's checking both.

X509_NAME_cmp() compares two X509_NAME objects, the ones passed as a and b — and heads up, either of them may be NULL 👀. the comparison is based on the memcmp result of the canonical (DER) encoding values of the two objects using i2d_X509_NAME(3). this one is a rule-follower fr fr: it adheres to the matching rules for Distinguished Names (DN) given in RFC 4517 section 4.2.15 and RFC 5280 section 7.1. in particular, the order of Relative Distinguished Names (RDNs) is relevant. but flip side: if an RDN is multi-valued — i.e. it contains a set of AttributeValueAssertions (AVAs) — then its members are effectively not ordered. iconic behavior honestly. 💅

X509_issuer_and_serial_cmp() compares the serial number and issuer values in the given X509 objects a and b. both. together. matching.

X509_issuer_name_cmp(), X509_subject_name_cmp() and X509_CRL_cmp() are, like, effectively wrappers of the X509_NAME_cmp() function — same energy, different entry point. these compare issuer names and subject names of the objects, or issuers of X509_CRL objects, respectively. so: issuer_name one does issuer names, subject_name one does subject names, and CRL_cmp does the issuers of X509_CRL objects.

X509_CRL_match() compares two X509_CRL objects. and here's the glow-up: unlike the X509_CRL_cmp() function, this one compares the whole CRL content instead of just the issuer name. main character energy for real — it looks at everything, not just the name on the label. 🌈

---

🔥 RETURN VALUES

the X509 comparison functions return -1, 0, or 1:

• -1 → object a is found to be less than object b
• 0 → they match
• 1 → object a is found to be greater than object b

and this next group — X509_NAME_cmp(), X509_issuer_and_serial_cmp(), X509_issuer_name_cmp(), X509_subject_name_cmp(), X509_CRL_cmp(), and X509_CRL_match() — may return -2 to indicate an error. so like, watch out for that one, she's the plot twist 😭

---

💀 NOTES

these functions in fact utilize the underlying memcmp of the C library to do the comparison job. it's a whole handoff situation. and the data being compared varies — from DER encoding data, to hash value, to ASN1_STRING. so it's not one uniform thing under the hood.

the sign of the comparison can be used to order the objects, but ngl it does not have a special meaning in some cases. so don't read too deep into it bestie 🙈

⚠️ also important: X509_NAME_cmp() and its wrappers utilize the value -2 to indicate errors in some circumstances, which could cause confusion for the applications. so yeah. -2 means error here, not "extra super less than". don't let it catch you off guard. 💀

---

👑 SEE ALSO

i2d_X509_NAME(3), i2d_X509(3)

---

🎀 COPYRIGHT

Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie — no cap, every flag and fact intact 🫶 this was X509_CMP(3ossl) from OpenSSL 3.5.0, dated 2026-09-25. slay, go compare some certificates responsibly ✨💅