X509_PUBKEY_NEW(3ossl)

📦

version 3.5.9 · 8 versions

3.5.9 · fedora 43, fedora 44 (latest)
3.5.9 · centos-stream 9
3.5.9 · centos-stream 10
3.5.9 · alpine 3.22
3.5.9 · alpine 3.23, alpine 3.24
3.5.8 · fedora 43
3.5.1 · fedora 43
3.5.5 · fedora 44

💖 X509_PUBKEY_NEW 💖

okay bestie, sit down, hydrate, because we're talking about X509_PUBKEY — the little struct that carries your public keys around in SubjectPublicKeyInfo format. this is part of OpenSSL and the manual page is literally called X509_PUBKEY_NEW(3ossl), so you know it's the real deal. no cap.

here's the full fam of functions this page covers, all in one glorious group chat:

X509_PUBKEY_new_ex, X509_PUBKEY_new, X509_PUBKEY_free, X509_PUBKEY_dup, X509_PUBKEY_set, X509_PUBKEY_get0, X509_PUBKEY_get, d2i_PUBKEY_ex, d2i_PUBKEY, i2d_PUBKEY, d2i_PUBKEY_ex_bio, d2i_PUBKEY_bio, d2i_PUBKEY_ex_fp, d2i_PUBKEY_fp, i2d_PUBKEY_fp, i2d_PUBKEY_bio, X509_PUBKEY_set0_public_key, X509_PUBKEY_set0_param, X509_PUBKEY_get0_param, X509_PUBKEY_eq — SubjectPublicKeyInfo public key functions.

that's a LOT of names but they're all serving the same vibe: public keys, encoded and decoded. 🦋

✨ SYNOPSIS ✨

#include <openssl/x509.h>

X509_PUBKEY *X509_PUBKEY_new_ex(OSSL_LIB_CTX *libctx, const char *propq);
X509_PUBKEY *X509_PUBKEY_new(void);
void X509_PUBKEY_free(X509_PUBKEY *a);
X509_PUBKEY *X509_PUBKEY_dup(const X509_PUBKEY *a);

int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey);
EVP_PKEY *X509_PUBKEY_get0(const X509_PUBKEY *key);
EVP_PKEY *X509_PUBKEY_get(const X509_PUBKEY *key);

EVP_PKEY *d2i_PUBKEY_ex(EVP_PKEY **a, const unsigned char **pp, long length,
                        OSSL_LIB_CTX *libctx, const char *propq);
EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, const unsigned char **pp, long length);
int i2d_PUBKEY(const EVP_PKEY *a, unsigned char **pp);

EVP_PKEY *d2i_PUBKEY_ex_bio(BIO *bp, EVP_PKEY **a, OSSL_LIB_CTX *libctx,
                            const char *propq);
EVP_PKEY *d2i_PUBKEY_bio(BIO *bp, EVP_PKEY **a);

EVP_PKEY *d2i_PUBKEY_ex_fp(FILE *fp, EVP_PKEY **a, OSSL_LIB_CTX *libctx,
                           const char *propq);
EVP_PKEY *d2i_PUBKEY_fp(FILE *fp, EVP_PKEY **a);

int i2d_PUBKEY_fp(const FILE *fp, EVP_PKEY *pkey);
int i2d_PUBKEY_bio(BIO *bp, const EVP_PKEY *pkey);

void X509_PUBKEY_set0_public_key(X509_PUBKEY *pub,
                                 unsigned char *penc, int penclen);
int X509_PUBKEY_set0_param(X509_PUBKEY *pub, ASN1_OBJECT *aobj,
                           int ptype, void *pval,
                           unsigned char *penc, int penclen);
int X509_PUBKEY_get0_param(ASN1_OBJECT **ppkalg,
                           const unsigned char **pk, int *ppklen,
                           X509_ALGOR **pa, const X509_PUBKEY *pub);
int X509_PUBKEY_eq(X509_PUBKEY *a, X509_PUBKEY *b);

🌸 DESCRIPTION 🌸

The X509_PUBKEY structure represents the ASN.1 SubjectPublicKeyInfo structure defined in RFC5280 and used in certificates and certificate requests. it's giving "certificate-adjacent royalty", honestly. 👑

X509_PUBKEY_new_ex() — allocates and initializes an X509_PUBKEY structure associated with the given OSSL_LIB_CTX in the libctx parameter. Any algorithm fetches associated with using the X509_PUBKEY object will use the property query string propq. See "ALGORITHM FETCHING" in crypto(7) for further information about algorithm fetching. yes bestie, this is the one with ✨options✨.
X509_PUBKEY_new() — the same as X509_PUBKEY_new_ex() except that the default (NULL) OSSL_LIB_CTX and a NULL property query string are used. the low-effort, high-reward version. 💅
X509_PUBKEY_dup() — creates a duplicate copy of the X509_PUBKEY object specified by a. twin energy. 🫶
X509_PUBKEY_free() — frees up X509_PUBKEY structure a. If a is NULL nothing is done. very chill of it.
X509_PUBKEY_set() — sets the public key in *x to the public key contained in the EVP_PKEY structure pkey. If *x is not NULL any existing public key structure will be freed. out with the old, in with the new. 💀
X509_PUBKEY_get0() — returns the public key contained in key. The returned value is an internal pointer which MUST NOT be freed after use. do NOT free it, i am begging. 🙈
X509_PUBKEY_get() — similar to X509_PUBKEY_get0() except the reference count on the returned key is incremented so it MUST be freed using EVP_PKEY_free() after use. this one you DO clean up after, bestie.
d2i_PUBKEY_ex() — decodes an EVP_PKEY structure using SubjectPublicKeyInfo format. Some public key decoding implementations may use cryptographic algorithms. In this case the supplied library context libctx and property query string propq are used. d2i_PUBKEY() does the same as d2i_PUBKEY_ex() except that the default library context and property query string are used.
i2d_PUBKEY() — encodes an EVP_PKEY structure using SubjectPublicKeyInfo format. the "i" is for "into bytes", the "d2i" is for "bytes back into struct". iconic naming convention, iykyk. 🌈
d2i_PUBKEY_bio(), d2i_PUBKEY_fp(), i2d_PUBKEY_bio() and i2d_PUBKEY_fp() — similar to d2i_PUBKEY() and i2d_PUBKEY() except they decode or encode using a BIO or FILE pointer.
d2i_PUBKEY_ex_bio() and d2i_PUBKEY_ex_fp() — similar to d2i_PUBKEY_ex() except they decode using a BIO or FILE pointer.
X509_PUBKEY_set0_public_key() — sets the public-key encoding of pub to the penclen bytes contained in buffer penc. Any earlier public-key encoding in pub is freed. penc may be NULL to indicate that there is no actual public key data. Ownership of the penc argument is passed to pub. 👑 handing over the keys, literally.
X509_PUBKEY_set0_param() — sets the public-key parameters of pub. The OID associated with the algorithm is set to aobj. The type of the algorithm parameters is set to type using the structure pval. If penc is not NULL the encoding of the public key itself is set to the penclen bytes contained in buffer penc and any earlier public-key encoding in pub is freed. On success ownership of all the supplied arguments is passed to pub so they must not be freed after the call. do not double-free. i said what i said. 🚨
X509_PUBKEY_get0_param() — retrieves the public key parameters from pub, *ppkalg is set to the associated OID and the encoding consists of *ppklen bytes at *pk, *pa is set to the associated AlgorithmIdentifier for the public key. If the value of any of these parameters is not required it can be set to NULL. All of the retrieved pointers are internal and must not be freed after the call. peek but don't touch. 👀
X509_PUBKEY_eq() — compares two X509_PUBKEY values. are they the same girl or not? 🎀

🦋 NOTES 🦋

The X509_PUBKEY functions can be used to encode and decode public keys in a standard format. very standardized. very demure.

In many cases applications will not call the X509_PUBKEY functions directly: they will instead call wrapper functions such as X509_get0_pubkey(). so if you've been using the wrappers this whole time, you're still valid, no worries. 💜

⭐ RETURN VALUES ⭐

If the allocation fails, X509_PUBKEY_new() and X509_PUBKEY_dup() return NULL and set an error code that can be obtained by ERR_get_error(3). Otherwise they return a pointer to the newly allocated structure.

X509_PUBKEY_free() does not return a value. it just does its thing and leaves. 🧚

X509_PUBKEY_get0(), X509_PUBKEY_get(), d2i_PUBKEY_ex(), d2i_PUBKEY(), d2i_PUBKEY_ex_bio(), d2i_PUBKEY_bio(), d2i_PUBKEY_ex_fp() and d2i_PUBKEY_fp() return a pointer to an EVP_PKEY structure or NULL if an error occurs.

i2d_PUBKEY() returns the number of bytes successfully encoded or a negative value if an error occurs.

i2d_PUBKEY_fp() and i2d_PUBKEY_bio() return 1 if successfully encoded or 0 if an error occurs.

X509_PUBKEY_set0_public_key() does not return a value. it's a void girlie. 💅

X509_PUBKEY_set(), X509_PUBKEY_set0_param() and X509_PUBKEY_get0_param() return 1 for success and 0 if an error occurred.

X509_PUBKEY_eq() returns 1 for equal, 0 for different, and < 0 on error. three outcomes, three moods. 💀

🎀 HISTORY 🎀

The X509_PUBKEY_new_ex() and X509_PUBKEY_eq() functions were added in OpenSSL 3.0. glow-up era.

The X509_PUBKEY_set0_public_key(), d2i_PUBKEY_ex_bio() and d2i_PUBKEY_ex_fp() functions were added in OpenSSL 3.2. later arrivals, still slaying.

💖 COPYRIGHT 💖

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

ok that's the whole page bestie, every flag, every pointer, every "must not be freed" warning intact. go forth and encode responsibly. 🫶✨

mwah — this was OpenSSL 3.5.9, dated 2026-09-29, and the page is X509_PUBKEY_NEW(3ossl). that's a wrap, periodt. 💅🌸

📦 where this page comes from

fedora 43: openssl-devel 1:3.5.9-1.fc43 · Apache-2.0
fedora 43: openssl-devel 1:3.5.9-1.fc43 · Apache-2.0
fedora 44: openssl-devel 1:3.5.9-1.fc44 · Apache-2.0
fedora 44: openssl-devel 1:3.5.9-1.fc44 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-14: a language model's rewrite of the original, under its terms