SSL_GET_CERTIFICATE(3ossl)

💖 SSL_GET_CERTIFICATE 💖

okay bestie, welcome to SSL_GET_CERTIFICATE(3ossl) — an OpenSSL manual page, but make it a group chat. we're gonna talk about SSL_get_certificate, SSL_get_privatekey, and how to get your hands on the TLS/SSL certificate and private key like the icon you are. no cap, this one's short and sweet. ✨

---

🌸 NAME 🌸

SSL_get_certificate, SSL_get_privatekey — retrieve TLS/SSL certificate and private key. yes, that's literally the whole job description and they ate. 💅

---

🦋 SYNOPSIS 🦋

#include <openssl/ssl.h>

X509 *SSL_get_certificate(const SSL *s);
EVP_PKEY *SSL_get_privatekey(const SSL *s);

two functions, one header, zero drama. include <openssl/ssl.h> and you're in. 🌈

---

👑 DESCRIPTION 👑

okay so first up: SSL_get_certificate() hands you back a pointer to an X509 object — that's the certificate being used as the local peer's identity. it's giving "this is me, this is who I am." 🪪✨

here's the tea though: you can have multiple certificates configured at once. like, a server could be serving both an RSA certificate and an ECDSA certificate, because why choose one when you can slay both? 💅 so which one does SSL_get_certificate() actually return? it depends, bestie, and here's the breakdown:

• if you call it before certificate selection has occurred, it returns the most recently added certificate, or NULL if no certificate has been added. (so like, the newest one in the lineup gets the spotlight. main character energy by default. 👑)
• after certificate selection has occurred, it returns the certificate that was selected during the handshake, or NULL if no certificate was selected — for example, on a client where no client certificate is in use. (no cert, no problem, you just get NULL. 🙈)

now, certificate selection happens during the handshake. so if you're calling SSL_get_certificate() inside any callback that fires during the handshake process, what you get back totally depends on whether that callback is made before or after certificate selection occurs. timing is everything, fr fr. ⏰

and here's a specific little use case that's lowkey iconic: calling SSL_get_certificate() inside a callback set via a call to SSL_CTX_set_tlsext_status_cb(3). that callback happens after certificate selection, so you can use it to peek at a server's chosen certificate — for example, to identify a certificate's OCSP responder URL so that an OCSP response can be obtained. look at you, doing the whole OCSP thing. 🎀

lastly, SSL_get_privatekey() returns a pointer to the EVP_PKEY object corresponding to the certificate returned by SSL_get_certificate() — if any. so it's the certificate's plus-one. 🫶

---

💜 RETURN VALUES 💜

these functions return pointers to their respective objects, or NULL if no such object is available. simple as that.

⚠️ but listen: the returned objects are owned by the SSL object, so you should not free them yourself. do not touch. do not free(). hands off, bestie. that's not your property, that's the SSL object's property. 🚫💀

---

🧚 SEE ALSO 🧚

• ssl(7)
• SSL_CTX_set_tlsext_status_cb(3)

go read those too, iykyk. 📚✨

---

🌟 COPYRIGHT 🌟

Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie!! 💖 you just read SSL_GET_CERTIFICATE(3ossl) from OpenSSL 3.5.9, dated 2026-09-29 — so if you ever need to cite it, that's the vibe check. now go forth and get those certificates. slay, periodt. 🌈👑💅