I2D_RE_X509_TBS(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 I2D_RE_X509_TBS (3ossl) — the OpenSSL manual, but make it make sense

okay bestie, so this is the OpenSSL manual page for the X509 encode/decode girlies ✨ — specifically d2i_X509_AUX, i2d_X509_AUX, i2d_re_X509_tbs, i2d_re_X509_CRL_tbs, and i2d_re_X509_REQ_tbs. Yes that's five (5) functions with names that look like someone fell asleep on a keyboard, but we're gonna get through it together 🫶

✨ SYNOPSIS ✨

like, the actual incantation:

#include <openssl/x509.h>

X509 *d2i_X509_AUX(X509 **px, const unsigned char **in, long len);
int i2d_X509_AUX(const X509 *x, unsigned char **out);
int i2d_re_X509_tbs(X509 *x, unsigned char **out);
int i2d_re_X509_CRL_tbs(X509_CRL *crl, unsigned char **pp);
int i2d_re_X509_REQ_tbs(X509_REQ *req, unsigned char **pp);

copy that exactly, no cap, these signatures are not vibes-based 💀

🌸 DESCRIPTION 🌸

So the X509 encode and decode routines encode and parse an X509 structure, which — plot twist — represents an X509 certificate. main character energy, honestly 👑

🎀 d2i_X509_AUX()

It's similar to d2i_X509(3), but the input is expected to consist of an X509 certificate followed by auxiliary trust information. This is what the PEM routines use to read "TRUSTED CERTIFICATE" objects.

🚨 Warning, fr fr: this function should not be called on untrusted input. Not being dramatic, it's literally in the manual. 🙈

🎀 i2d_X509_AUX()

Similar to i2d_X509(3), except the encoded output contains both the certificate and any auxiliary trust information. This is what the PEM routines use to write "TRUSTED CERTIFICATE" objects.

💡 Heads up: this is a non-standard OpenSSL-specific data format. It's giving "we made this ourselves", and honestly? iconic of them.

🎀 i2d_re_X509_tbs()

Similar to i2d_X509(3) except it encodes only the TBSCertificate portion of the certificate. The "re" in i2d_re_X509_tbs stands for "re-encode", and it ensures a fresh encoding is generated in case the object has been modified after creation (peep the BUGS section 👀).

i2d_re_X509_CRL_tbs() and i2d_re_X509_REQ_tbs() are analogous — for CRL and certificate request respectively. Same energy, different object 💅

🎀 the caching situation

The encoding of the TBSCertificate portion of a certificate is cached in the X509 structure internally to improve encoding performance and to ensure certificate signatures are verified correctly in some certificates with broken (non-DER) encodings. so it's a speed thing and a "some certs are built different" thing. both. slay 🦋

If, after modification, the X509 object is re-signed with X509_sign(), the encoding is automatically renewed. Otherwise, you can manually renew the encoding of the TBSCertificate portion of the X509 by calling i2d_re_X509_tbs(). DIY energy ✨

🔥 RETURN VALUES 🔥

  • d2i_X509_AUX() — returns a valid X509 structure, or NULL if an error occurred. bestie is either thriving or absolutely not 😭
  • i2d_X509_AUX() — returns the length of encoded data, or -1 on error.
  • i2d_re_X509_tbs(), i2d_re_X509_CRL_tbs() and i2d_re_X509_REQ_tbs() — return the length of encoded data, or <=0 on error. yes, <=0, not just -1, read it and weep 🫠

👑 SEE ALSO 👑

the whole friend group, go say hi:

Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole thing, bestie 🎀 tysm for reading — this page was brought to you by OpenSSL 3.5.0, dated 2026-09-25, and documented under the name I2D_RE_X509_TBS(3ossl). go forth and encode responsibly 💖✨

📦 where this page comes from