SSL_GET_PEER_CERT_CHAIN(3ossl)

💖 SSL_GET_PEER_CERT_CHAIN 💖

okay bestie, welcome to the 3ossl corner of the OpenSSL manual — yes it's giving "certificate chain of the peer" and honestly? it's lowkey iconic. let's get into it 🎀

---

✨ NAME ✨

SSL_get_peer_cert_chain, SSL_get0_verified_chain — get the X509 certificate chain of the peer 🦋

---

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *ssl);
STACK_OF(X509) *SSL_get0_verified_chain(const SSL *ssl);

---

💅 DESCRIPTION 💅

okay so, two functions, two whole vibes:

SSL_get_peer_cert_chain() hands you back a pointer to a STACK_OF(X509) — that's the certificate chain the peer literally sent you. and here's the tea 🍵: if you call it on the client side, the stack also contains the peer's certificate. but if you call it on the server side? nope, the peer's certificate has to be obtained separately using SSL_get_peer_certificate(3). and if the peer just... didn't present a certificate at all? NULL comes back. sorry babe 😭

NB: SSL_get_peer_cert_chain() returns the peer chain as sent by the peer — it only consists of certificates the peer has sent, in the order the peer has sent them. it is not a verified chain. no cap. don't trust it like it's been checked, because it hasn't 💀

SSL_get0_verified_chain() is the glow-up version ✨ — it returns the verified certificate chain of the peer, including the peer's end entity certificate. but there's a catch: you must call it after a session has been successfully established. and if peer verification was not successful (which you can spot by SSL_get_verify_result() not returning X509_V_OK), then the chain may be incomplete or invalid. proceed with caution, bestie 🙈

---

📝 NOTES 📝

• if the session is resumed, peers do not send certificates, so these functions return a NULL pointer. apps can call SSL_session_reused() to figure out whether a session is resumed. handy, right? 🫶
• the reference count of each certificate in the returned STACK_OF(X509) object is not incremented, and the returned stack may be invalidated by renegotiation. so if your app wants to hold onto any certificates in that chain indefinitely, you gotta bump those reference counts yourself using X509_up_ref(), or grab a copy of the whole chain with X509_chain_up_ref(). do not skip this step, i'm begging 🙏

---

🔥 RETURN VALUES 🔥

here's what can come back at you:

• NULL — no certificate was presented by the peer, or no connection was established, or the certificate chain is no longer available when a session is reused. it's giving "nothing to see here" 💀
• Pointer to a STACK_OF(X509) — the return value points to the certificate chain presented by the peer. slay 💅

---

👑 SEE ALSO 👑

ssl(7), SSL_get_peer_certificate(3), X509_up_ref(3), X509_chain_up_ref(3)

---

🎀 COPYRIGHT 🎀

Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie!! this one's from OpenSSL 3.5.9, dated 2026-09-29, and it lives in the 3ossl manual family 💖 go forth and chain those certs responsibly, mwah 🫶✨