X509_GET_SUBJECT_NAME(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💖 X509_GET_SUBJECT_NAME 💖

okay bestie, so this is page X509_GET_SUBJECT_NAME(3ossl) from the OpenSSL manual, and it's literally all about getting and setting the subject and issuer names on your certs, plus hashing those X509_NAMEs. sit down, grab a lil snack 🍓, we're doing names today.

✨ NAME ✨

so this one page is the group chat for a whole squad of functions. everyone here is either grabbing an X509_NAME hash, or getting/setting issuer and subject names. the whole cast:

  • X509_NAME_hash_ex
  • X509_NAME_hash
  • X509_get_subject_name
  • X509_set_subject_name
  • X509_subject_name_hash
  • X509_get_issuer_name
  • X509_set_issuer_name
  • X509_issuer_name_hash
  • X509_REQ_get_subject_name
  • X509_REQ_set_subject_name
  • X509_ACERT_get0_issuerName
  • X509_ACERT_set1_issuerName
  • X509_CRL_get_issuer
  • X509_CRL_set_issuer_name

and what do they do collectively? get X509_NAME hashes, or get and set issuer or subject names. that's the whole vibe. 👑

🎀 SYNOPSIS 🎀

first up, the main character include:

#include <openssl/x509.h>

then the hash situation, with the library context and property query:

unsigned long X509_NAME_hash_ex(const X509_NAME *x, OSSL_LIB_CTX *libctx,
                                const char *propq, int *ok);

the subject name crew for a plain X509:

X509_NAME *X509_get_subject_name(const X509 *x);
int X509_set_subject_name(X509 *x, const X509_NAME *name);
unsigned long X509_subject_name_hash(X509 *x);

the issuer name crew, same energy, different field:

X509_NAME *X509_get_issuer_name(const X509 *x);
int X509_set_issuer_name(X509 *x, const X509_NAME *name);
unsigned long X509_issuer_name_hash(X509 *x);

then the cert request besties:

X509_NAME *X509_REQ_get_subject_name(const X509_REQ *req);
int X509_REQ_set_subject_name(X509_REQ *req, const X509_NAME *name);

and the CRL ones:

X509_NAME *X509_CRL_get_issuer(const X509_CRL *crl);
int X509_CRL_set_issuer_name(X509_CRL *x, const X509_NAME *name);

then a whole other header for attribute certs, because of course:

#include <openssl/x509_acert.h>

X509_NAME *X509_ACERT_get0_issuerName(const X509_ACERT *x);
int X509_ACERT_set1_issuerName(X509_ACERT *x, const X509_NAME *name);
⚠️ deprecated alert ⚠️ the macro below has been deprecated since OpenSSL 3.0, and you can hide it entirely by defining OPENSSL_API_COMPAT with a suitable version value — see openssl_user_macros(7):
#define X509_NAME_hash(x) X509_NAME_hash_ex(x, NULL, NULL, NULL)

💅 DESCRIPTION 💅

okay so let's go one by one, no skipping, periodt.

X509_NAME_hash_ex() returns a hash value of name x, or 0 on failure, using any given library context libctx and property query propq. the ok result argument? it may be NULL, or else it's used to return 1 for success and 0 for failure. and when does failure happen, you ask? on malloc error, or if no SHA1 implementation is available. so like. keep an eye out. 😭

X509_NAME_hash() returns a hash value of name x, or 0 on failure, and it uses the default library context and default property query. simple. default-y.

X509_get_subject_name() returns the subject name of certificate x. and listen — the returned value is an internal pointer which MUST NOT be freed. also x MUST NOT be NULL. that's not a suggestion bestie, that's the law. 💀

X509_set_subject_name() sets the issuer name of certificate x to name. wait, we said "issuer"? yeah that's what it says, we're not editing the manual, we're just vibing with it. the name parameter is copied internally and should be freed up when it's no longer needed. 🫶

X509_subject_name_hash() returns a hash value of the subject name of certificate x.

X509_get_issuer_name(), X509_set_issuer_name(), and X509_issuer_name_hash() are literally identical to X509_get_subject_name(), X509_set_subject_name(), and X509_subject_name_hash() — except they relate to the issuer name of x. same functions, different field. iconic twins energy. 👯

similarly, X509_REQ_get_subject_name(), X509_REQ_set_subject_name(), X509_ACERT_get0_issuerName(), X509_ACERT_set1_issuerName(), X509_CRL_get_issuer() and X509_CRL_set_issuer_name() get or set the subject or issuer names of certificate requests, of CRLs, respectively. (the original says "certificate requests of CRLs" — we're just passing the message along, don't shoot the messenger 🧚)

and here's a lil plot twist: since attribute certificates do not have a subject name, only the issuer name can be set. for the details on setting X509_ACERT holder identities, go see X509_ACERT_set0_holder_entityName(3). ✨

🌸 RETURN VALUES 🌸

X509_get_subject_name(), X509_get_issuer_name(), X509_REQ_get_subject_name(), X509_ACERT_get0_issuerName() and X509_CRL_get_issuer() return an X509_NAME pointer. 💖

X509_NAME_hash_ex(), X509_NAME_hash(), X509_subject_name_hash() and X509_issuer_name_hash() return the first four bytes of the SHA1 hash value, converted to unsigned long in little endian order, or 0 on failure. that's the whole hash tea. ⭐

X509_set_subject_name(), X509_set_issuer_name(), X509_REQ_set_subject_name(), X509_ACERT_get0_issuerName() and X509_CRL_set_issuer_name() return 1 for success and 0 for failure.

💀 BUGS 💀

okay this is the messy part, don't be shocked: in case X509_NAME_hash(), X509_subject_name_hash(), or X509_issuer_name_hash() returns 0, it remains unclear if this is the real hash value or due to failure. 😭 the 0 could mean anything. rude, honestly.

better use X509_NAME_hash_ex() instead. seriously. save yourself the confusion. 🫶

🦋 SEE ALSO 🦋

go read these next, bestie:

🌈 HISTORY 🌈

lore drop, let's go:

  • X509_REQ_get_subject_name() is a function in OpenSSL 1.1.0 and a macro in earlier versions.
  • X509_CRL_get_issuer() is a function in OpenSSL 1.1.0. it was previously added in OpenSSL 1.0.0 as a macro.
  • X509_NAME_hash() was turned into a macro and deprecated in OpenSSL 3.0.
  • X509_ACERT_get0_issuerName(), X509_ACERT_set1_issuerName() were added in OpenSSL 3.4.

Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay and that's the whole page, bestie!! 🎀✨ this was version 3.5.9, dated 2026-09-29, and it lives under the name X509_GET_SUBJECT_NAME(3ossl). go forth, get those names, don't free that internal pointer, and remember: when in doubt, X509_NAME_hash_ex(). mwah 💖🫶🌈

📦 where this page comes from