SCT_VALIDATE(3ossl)

💖 SCT_VALIDATE(3ossl) — the OpenSSL manual, but make it make sense ✨

okay so bestie, we're in SCT_VALIDATE(3ossl) territory, which is part of the OpenSSL fam 🫶 and it's all about checking whether Signed Certificate Timestamps (SCTs) are actually valid. yes queen, certificate transparency lore. let's get into it 💅

---

✨ NAME ✨

SCT_validate, SCT_LIST_validate, SCT_get_validation_status — they check that Signed Certificate Timestamps (SCTs) are valid. that's the whole job. no cap 🎀

---

🌸 SYNOPSIS 🌸

#include <openssl/ct.h>

typedef enum {
    SCT_VALIDATION_STATUS_NOT_SET,
    SCT_VALIDATION_STATUS_UNKNOWN_LOG,
    SCT_VALIDATION_STATUS_VALID,
    SCT_VALIDATION_STATUS_INVALID,
    SCT_VALIDATION_STATUS_UNVERIFIED,
    SCT_VALIDATION_STATUS_UNKNOWN_VERSION
} sct_validation_status_t;

int SCT_validate(SCT *sct, const CT_POLICY_EVAL_CTX *ctx);
int SCT_LIST_validate(const STACK_OF(SCT) *scts, CT_POLICY_EVAL_CTX *ctx);
sct_validation_status_t SCT_get_validation_status(const SCT *sct);

like, look at that enum. six whole statuses. it's giving options 💅

---

🦋 DESCRIPTION 🦋

so SCT_validate() checks that one SCT is valid and verifies its signature. iconic behavior honestly. and SCT_LIST_validate()? same energy, but for an entire stack of SCTs — it does all the same checks on the whole STACK_OF(SCT) at once. 🌈

wanna know how it went? just pass the SCT to SCT_get_validation_status() and it'll tell you the tea. periodt.

now, you must hand over a CT_POLICY_EVAL_CTX that specifies:

• the certificate the SCT was issued for 🎀

if you don't provide it, the validation status ends up as SCT_VALIDATION_STATUS_UNVERIFIED. awkward.

• the issuer of that certificate 💖

this one's only needed if the SCT was issued for a pre-certificate (see RFC 6962 — yes, we're citing RFCs, we contain multitudes). if it is required but you didn't provide it, the validation status will be SCT_VALIDATION_STATUS_UNVERIFIED. again.

• a CTLOG_STORE that contains the CT log that issued this SCT 👑

if the SCT came from a log that isn't in this CTLOG_STORE, the validation status will be SCT_VALIDATION_STATUS_UNKNOWN_LOG. it's literally not on the list, bestie.

and then:

• if the SCT is of an unsupported version (only v1 is currently supported, jsyk), the validation status will be SCT_VALIDATION_STATUS_UNKNOWN_VERSION 💀
• if the SCT's signature is incorrect, or its timestamp is in the future (relative to the time in CT_POLICY_EVAL_CTX), or if it's otherwise invalid, the validation status will be SCT_VALIDATION_STATUS_INVALID 🙈
• and if all the checks pass? the validation status will be SCT_VALIDATION_STATUS_VALID 🎉 slay!! main character ending!!

---

🌟 NOTES 🌟

do not read a return value of 0 from SCT_LIST_validate() as a failure. fr fr.

at a minimum, only one valid SCT may provide sufficient confidence that a certificate has been publicly logged. so like, one is enough to be confident. one single baddie SCT carrying the whole vibe check. 💅

---

⭐ RETURN VALUES ⭐

• SCT_validate() returns a negative integer if an internal error occurs 😭, 0 if the SCT fails validation 💀, or 1 if the SCT passes validation 🔥
• SCT_LIST_validate() returns a negative integer if an internal error occurs 😭, 0 if any of SCTs fails validation 💀, or 1 if they all pass validation 🔥
• SCT_get_validation_status() returns the validation status of the SCT. and if SCT_validate() or SCT_LIST_validate() have not been passed that SCT, the returned value will be SCT_VALIDATION_STATUS_NOT_SET — like, we simply don't know her yet 🫶

---

🌈 SEE ALSO 🌈

• ct(7)

(the crossover episode you didn't know you needed)

---

🧚 HISTORY 🧚

these functions were added in OpenSSL 1.1.0. vintage but still serving ✨

---

💜 COPYRIGHT 💜

Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

okay that's the whole page, bestie, you ate 🍓💅 and btw this was OpenSSL version 3.5.9, dated 2026-09-29 — mwah, love u, go validate some SCTs 😭💖