X509_CHECK_CA(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💅 X509_CHECK_CA(3ossl) — the OpenSSL girlies' guide

okay so bestie, welcome to X509_check_ca from the OpenSSL manual, part 3ossl. this is the one that tells you whether a cert is a CA cert or not. short page, but the lore?? immaculate. let's get into it 🎀

✨ NAME ✨

X509_check_ca — check if given certificate is CA certificate

like. that's literally it. it checks if ur cert is a CA cert. periodt. 💖

🌸 SYNOPSIS 🌸

#include <openssl/x509v3.h>

int X509_check_ca(X509 *cert);

so you pull in <openssl/x509v3.h>, you hand it a X509 *cert, and it hands you back an int. that's the whole vibe check 🦋

💜 DESCRIPTION 💜

so like, this function checks if the given certificate is a CA certificate — meaning a cert that can be used to sign other certificates. she's got main character energy and signing privileges, basically. 👑

IMPORTANT bestie: the certificate must be a complete certificate, otherwise an error is returned. don't be out here passing her half a cert, she will not play that game. 🚫

🫶 RETURN VALUES 🫶

okay so this is the part where it gets juicy, because she does NOT just give you a yes/no. she gives you a whole taxonomy:

  • 0 — nope, not a CA certificate. not the moment.
  • 1 — YES bestie, it's a proper X509v3 CA certificate with the basicConstraints extension set to CA:TRUE. the real deal. 💖
  • 3 — it's a self-signed X509 v1 certificate. vintage. iconic. ✨
  • 4 — it's a certificate with the keyUsage extension with the bit keyCertSign set, but without basicConstraints. no cap.
  • 5 — it's got that outdated Netscape Certificate Type extension telling everybody it's a CA certificate. grandma cert energy, we still respect her 🎀

also, this function will return 0 on error too. so a zero is like... either "no" or "something went wrong," and she's not gonna tell you which. classic. 😭

and actually — ANY nonzero value means that this certificate could have been used to sign other certificates. so if you're just vibing and checking "could this sign stuff," any nonzero = yes. that's the shortcut. iykyk 💅

(also not me noticing there's no 2 in that list... she skipped it. we don't ask. 🙈)

🌈 SEE ALSO 🌈

go read these next, they're all in the same friend group:

Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page bestie, tysm for reading, go check some certs, stay hydrated, and remember: any nonzero is a yes. 💖✨🦋

signed off from OpenSSL 3.5.9, dated 2026-09-29 — mwah, xoxo 💅

📦 where this page comes from