X509_CRL_GET0_BY_SERIAL(3ossl)

💖 NAME 💖

okay bestie, gather round, because this is the CRL revoked entry utility functions page, and it's lowkey a whole squad:

• X509_CRL_get0_by_serial
• X509_CRL_get0_by_cert
• X509_CRL_get_REVOKED
• X509_REVOKED_get0_serialNumber
• X509_REVOKED_get0_revocationDate
• X509_REVOKED_set_serialNumber
• X509_REVOKED_set_revocationDate
• X509_CRL_add0_revoked
• X509_CRL_sort

this is the X509_CRL_GET0_BY_SERIAL(3ossl) manual page from OpenSSL, and it's giving ✨ certificate revocation list administration ✨, so let's get into it 💅

---

✨ SYNOPSIS ✨

#include <openssl/x509.h>

int X509_CRL_get0_by_serial(X509_CRL *crl,
                            X509_REVOKED **ret, const ASN1_INTEGER *serial);
int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x);

STACK_OF(X509_REVOKED) *X509_CRL_get_REVOKED(X509_CRL *crl);

const ASN1_INTEGER *X509_REVOKED_get0_serialNumber(const X509_REVOKED *r);
const ASN1_TIME *X509_REVOKED_get0_revocationDate(const X509_REVOKED *r);

int X509_REVOKED_set_serialNumber(X509_REVOKED *r, ASN1_INTEGER *serial);
int X509_REVOKED_set_revocationDate(X509_REVOKED *r, ASN1_TIME *tm);

int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev);

int X509_CRL_sort(X509_CRL *crl);

---

🌸 DESCRIPTION 🌸

so here's the tea, one function at a time 🫶

• X509_CRL_get0_by_serial() — it's tryna find a revoked entry inside crl that matches the serial number serial. if it pulls it off, it sets *ret to the internal pointer of the matching entry. and because it's internal, you MUST NOT free *ret after the call. like, don't. it's not yours. 🙈
• X509_CRL_get0_by_cert() — basically the same energy as X509_get0_by_serial() except it hunts for the revoked entry using the serial number of certificate x instead. same vibes, different lookup key ✨
• X509_CRL_get_REVOKED() — hands you an internal pointer to a STACK containing all the revoked entries for crl. the whole roster, no cap 👑
• X509_REVOKED_get0_serialNumber() — gives you an internal pointer to the serial number of r. 🎀
• X509_REVOKED_get0_revocationDate() — gives you an internal pointer to the revocation date of r. 🦋
• X509_REVOKED_set_serialNumber() — sets the serial number of r to serial. important bestie: the supplied serial pointer is not used internally, so it's on you to free it after use. 💅
• X509_REVOKED_set_revocationDate() — sets the revocation date of r to tm. same deal: the supplied tm pointer is not used internally, so free it after use, mmkay?
• X509_CRL_add0_revoked() — appends the revoked entry rev to the CRL crl. but listen, the pointer rev IS used internally, so it MUST NOT be freed after the call — it gets freed when the parent CRL gets freed. the CRL adopts it, basically. it's family now 🥺
• X509_CRL_sort() — sorts the revoked entries of crl into ascending serial number order. tidy queen behavior 🧹✨

---

📝 NOTES 📝

if you're wondering how many revoked entries you just got back from X509_CRL_get_REVOKED(), you can count them with sk_X509_REVOKED_num() and then peek at each one in turn using sk_X509_REVOKED_value(). that's the whole trick, iykyk 💫

---

🎯 RETURN VALUES 🎯

okay this part is important so pay attention bestie:

• X509_CRL_get0_by_serial() and X509_CRL_get0_by_cert() return 0 for failure, 1 on success — except if the revoked entry has the reason "removeFromCRL" (8), in which case 2 is returned. yeah. a whole surprise 2. not me being caught off guard 😭
• X509_CRL_get_REVOKED() returns a STACK of revoked entries. 📚
• X509_REVOKED_get0_serialNumber() returns an ASN1_INTEGER structure.
• X509_REVOKED_get0_revocationDate() returns an ASN1_TIME structure.
• X509_REVOKED_set_serialNumber(), X509_REVOKED_set_revocationDate(), X509_CRL_add0_revoked() and X509_CRL_sort() all return 1 for success and 0 for failure. consistent icons, honestly 🌈

---

👀 SEE ALSO 👀

go read these too, they're the extended universe fr fr:

d2i_X509(3), ERR_get_error(3), X509_get0_signature(3), X509_get_ext_d2i(3), X509_get_extension_flags(3), X509_get_pubkey(3), X509_get_subject_name(3), X509_get_version(3), X509_NAME_add_entry_by_txt(3), X509_NAME_ENTRY_get_object(3), X509_NAME_get_index_by_NID(3), X509_NAME_print_ex(3), X509_new(3), X509_sign(3), X509V3_get_d2i(3), X509_verify_cert(3)

---

📜 COPYRIGHT 📜

Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's a wrap on the X509_CRL_GET0_BY_SERIAL(3ossl) page from OpenSSL — this version is 3.5.9, dated 2026-09-29. stan a documentation glow-up, mwah 💋✨🎀