SSL_CHECK_CHAIN(3ossl)

💖 NAME 💖

okay bestie, say hi to SSL_check_chain — it's the OpenSSL function that checks whether a certificate chain is even suitable for the session you're in. that's it, that's the whole job. slay. ✨

this is SSL_CHECK_CHAIN(3ossl), straight out of the OpenSSL manual, and yes we're reading it together like it's a group chat. 🫶

---

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain);

like… look at those parameters. s, x, pk, chain. four little besties. 💅

---

💜 DESCRIPTION 💜

so SSL_check_chain() checks whether the certificate x, the private key pk, and the certificate chain chain are suitable for use with the current session s.

that's it. it's a vibe check for your chain. 🔥

---

🎀 RETURN VALUES 🎀

SSL_check_chain() hands you back a bitmap of flags — like a little scorecard telling you what's valid about the chain. every flag is its own lil moment:

• CERT_PKEY_VALID — the chain can be used with the current session. and bestie, listen: if this flag is not set, the certificate will never be used, even if the application tries to set it, because it's inconsistent with the peer preferences. no cap. it's giving rejected. 💀
• CERT_PKEY_SIGN — the EE key can be used for signing.
• CERT_PKEY_EE_SIGNATURE — the signature algorithm of the EE certificate is acceptable.
• CERT_PKEY_CA_SIGNATURE — the signature algorithms of all CA certificates are acceptable.
• CERT_PKEY_EE_PARAM — the parameters of the end entity certificate are acceptable (e.g. it is a supported curve).
• CERT_PKEY_CA_PARAM — the parameters of all CA certificates are acceptable.
• CERT_PKEY_EXPLICIT_SIGN — the end entity certificate algorithm can be used explicitly for signing (i.e. it is mentioned in the signature algorithms extension).
• CERT_PKEY_ISSUER_NAME — the issuer name is acceptable. this one is only meaningful for client authentication, fyi.
• CERT_PKEY_CERT_TYPE — the certificate type is acceptable. also only meaningful for client authentication.
• CERT_PKEY_SUITEB — chain is suitable for Suite B use.

okay so that's the whole flag roster, all ten of them, accounted for. 💅

---

🦋 NOTES 🦋

timing matters, bestie. SSL_check_chain() must be called in servers after a client hello message, or in clients after a certificate request message. it will typically be called in the certificate callback. if you call it at the wrong moment it's just not that girl. 😭

if your application wants to support multiple certificate chains, you may call this function on each chain in turn: starting with the one it considers the most secure. then it could use the chain of the first set which returns suitable flags. first one that passes the vibe check? use it. ✨

as a minimum, the flag CERT_PKEY_VALID must be set for a chain to be usable. an application supporting multiple chains with different CA signature algorithms may also wish to check CERT_PKEY_CA_SIGNATURE too. and if no chain is suitable, a server should fall back to the most secure chain which sets CERT_PKEY_VALID.

how is a chain's validity even determined? by checking if it matches a supported signature algorithm, supported curves, and — in the case of client authentication — certificate types and issuer names.

and here's the tea 🍓: since the supported signature algorithms extension is only used in TLS 1.2, TLS 1.3 and DTLS 1.2, the results for earlier versions of TLS and DTLS may not be very useful. applications may wish to specify a different "legacy" chain for earlier versions of TLS or DTLS. iconic behavior, honestly.

---

🌈 SEE ALSO 🌈

• SSL_CTX_set_cert_cb(3)
• ssl(7)

go read those too, iykyk. 💜

---

👑 COPYRIGHT 👑

Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie!! this was OpenSSL 3.5.9, dated 2026-09-29, page SSL_CHECK_CHAIN(3ossl) — go forth and check those chains, you're gonna ate 💅✨🎀🦋