X509_GET_PUBKEY(3ossl)

✨ X509_GET_PUBKEY ✨

okay bestie, welcome to the X509_GET_PUBKEY(3ossl) page, straight outta the OpenSSL manual 💖 this one's all about grabbing (or setting) the public key on a certificate or a certificate request, and honestly? it's giving "small page, big responsibilities" 👑

---

🌸 NAME 🌸

X509_get_pubkey, X509_get0_pubkey, X509_set_pubkey, X509_get_X509_PUBKEY, X509_REQ_get_pubkey, X509_REQ_get0_pubkey, X509_REQ_set_pubkey, X509_REQ_get_X509_PUBKEY — get or set certificate or certificate request public key 🗝️✨

---

🎀 SYNOPSIS 🎀

#include <openssl/x509.h>

EVP_PKEY *X509_get_pubkey(X509 *x);
EVP_PKEY *X509_get0_pubkey(const X509 *x);
int X509_set_pubkey(X509 *x, EVP_PKEY *pkey);
X509_PUBKEY *X509_get_X509_PUBKEY(const X509 *x);

EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req);
EVP_PKEY *X509_REQ_get0_pubkey(X509_REQ *req);
int X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey);
X509_PUBKEY *X509_REQ_get_X509_PUBKEY(X509_REQ *x);

---

🦋 DESCRIPTION 🦋

okay so first up, X509_get_pubkey() — she attempts to decode the public key for certificate x 🔓 if it works out, she hands you the public key as an EVP_PKEY pointer, with its reference count incremented. and bestie, that detail MATTERS: it means you gotta free the returned key after you're done with it 🫶

then there's X509_get0_pubkey(), which is basically the same vibe except she does not bump the reference count of the EVP_PKEY she gives back. so you must not free it up after use. the "0" is literally the whole personality, iykyk 💅

X509_get_X509_PUBKEY() returns an internal pointer to the X509_PUBKEY structure that encodes the certificate of x. and again — that returned value must not be freed up after use. not yours to free, bestie 🙈

X509_set_pubkey() tries to set the public key for certificate x to pkey 🔐 and yes, the key pkey should be freed up after use.

and then we got the REQ girlies: X509_REQ_get_pubkey(), X509_REQ_get0_pubkey(), X509_REQ_set_pubkey() and X509_REQ_get_X509_PUBKEY() — same energy as all of the above, except they operate on certificate request req 🎀

---

💜 NOTES 💜

the very first time a public key gets decoded, the EVP_PKEY structure gets cached inside the certificate or certificate request itself 🧠✨ so every call after that just returns the cached structure — with its reference count incremented — because performance is the moment and we're obsessed 💅🔥

---

🌈 RETURN VALUES 🌈

X509_get_pubkey(), X509_get0_pubkey(), X509_get_X509_PUBKEY(), X509_REQ_get_pubkey() and X509_REQ_get_X509_PUBKEY() return a public key, or NULL if an error occurred 😭

X509_set_pubkey() and X509_REQ_set_pubkey() return 1 for success and 0 for failure. simple as that, periodt 💯

---

👑 SEE ALSO 👑

• d2i_X509(3)
• ERR_get_error(3)
• X509_CRL_get0_by_serial(3)
• X509_get0_signature(3)
• X509_get_ext_d2i(3)
• X509_get_extension_flags(3)
• X509_get_subject_name(3)
• X509_get_version(3)
• X509_NAME_add_entry_by_txt(3)
• X509_NAME_ENTRY_get_object(3)
• X509_NAME_get_index_by_NID(3)
• X509_NAME_print_ex(3)
• X509_new(3)
• X509_sign(3)
• X509V3_get_d2i(3)
• X509_verify_cert(3)

go read those too, bestie, they're all in the same friend group 🫶

---

📜 COPYRIGHT 📜

Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. 💖

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

ok that's the whole page!! no cap, every flag, every function, every caveat is still in there 🧚

and that's a wrap, my love — this was X509_GET_PUBKEY(3ossl), version 3.5.9, dated 2026-09-29, and yes she really did show up with her full title X509_GET_PUBKEY(3ossl) like the main character she is 👑💅 bye bestie, hydrate and free your EVP_PKEYs 🌸🦋