X509(3pm)

💅 NAME 💅

Crypt::OpenSSL::X509 — a Perl extension to OpenSSL's X509 API. (It's from the User Contributed Perl Documentation, iykyk — that's the manual name, bestie 🎀)

---

✨ SYNOPSIS ✨

  use Crypt::OpenSSL::X509;

  my $x509 = Crypt::OpenSSL::X509->new_from_file('cert.pem');

  print $x509->pubkey() . "\n";
  print $x509->subject() . "\n";
  print $x509->hash() . "\n";
  print $x509->email() . "\n";
  print $x509->issuer() . "\n";
  print $x509->issuer_hash() . "\n";
  print $x509->notBefore() . "\n";
  print $x509->notAfter() . "\n";
  print $x509->modulus() . "\n";
  print $x509->exponent() . "\n";
  print $x509->fingerprint_md5() . "\n";
  print $x509->fingerprint_sha256() . "\n";
  print $x509->as_string() . "\n";

  my $x509 = Crypt::OpenSSL::X509->new_from_string(
    $der_encoded_data, Crypt::OpenSSL::X509::FORMAT_ASN1
  );

  # given a time offset of $seconds, will the certificate be valid?
  if ($x509->checkend($seconds)) {
    # cert is expired at $seconds offset
  } else {
    # cert is ok at $seconds offset
  }

  my $exts = $x509->extensions_by_oid();

  foreach my $oid (keys %$exts) {
    my $ext = $$exts{$oid};
    print $oid, " ", $ext->object()->name(), ": ", $ext->value(), "\n";
  }

---

🦋 ABSTRACT 🦋

Crypt::OpenSSL::X509 — Perl extension to OpenSSL's X509 API. That's it, that's the vibe 💜

---

🌸 DESCRIPTION 🌸

Okay so this module implements a large majority of OpenSSL's useful X509 API. She's thorough, she's doing the most, we love her for it 👑

The email() method supports both certificates where the subject is of the form:

"... CN=Firstname lastname/emailAddress=user@domain"

…and also certificates where there's an X509v3 Extension of the form:

"X509v3 Subject Alternative Name: email=user@domain"

So like, either way you're getting that email, no cap 💖

🧚 SUPPORTED OPENSSL VERSIONS 🧚

This module supports multiple versions of OpenSSL and maintains backward compatibility — she's not like other girls, she gets along with everyone:

• OpenSSL 1.0.x — legacy support (1.0.2 and later)
• OpenSSL 1.1.x — full support
• OpenSSL 2.x — (not a thing bestie, keep scrolling)
• OpenSSL 3.x — full support (current stable)
• OpenSSL 4.x — full support (with ASN1 opaque structure compatibility)
• LibreSSL 2.x/3.x — compatible

OpenSSL 4.0.0 introduced opaque ASN1 string types, which requires using accessor functions instead of direct structure member access. This module uses conditional compilation to keep compatibility across all versions while supporting the new OpenSSL 4.x API requirements. Lowkey iconic of her honestly 💅

🎀 EXPORT 🎀

None by default. She respects your boundaries 🫶

On request:

        FORMAT_UNDEF FORMAT_ASN1 FORMAT_TEXT FORMAT_PEM
        FORMAT_PKCS12 FORMAT_SMIME FORMAT_ENGINE FORMAT_IISSGC

---

🔥 FUNCTIONS 🔥

💫 X509 CONSTRUCTORS 💫

• new ( ) — creates a brand-new X509 object. Fresh out the box ✨
• new_from_string ( STRING [ FORMAT ] )
• new_from_file ( FILENAME [ FORMAT ] ) — create a new X509 object from a string or a file. FORMAT should be FORMAT_ASN1 or FORMAT_PEM, bestie, don't forget 💀

⭐ X509 ACCESSORS ⭐

• subject — subject name as a string.
• issuer — issuer name as a string.
• issuer_hash — issuer name hash as a string.
• serial — serial number as a string.
• hash — alias for subject_hash. Same energy, different name.
• subject_hash — subject name hash as a string.
• notBefore — notBefore time as a string.
• notAfter — notAfter time as a string.
• email — email addresses as a string. If it finds multiple addresses, they're separated by a space (' '). She's not messy, she's organized 💅
• version — certificate version as a string.
• sig_alg_name — signature algorithm name as a string.
• key_alg_name — public key algorithm name as a string.
• curve — name of the EC curve used in the public key.

🌈 X509 METHODS 🌈

• subject_name ( )
• issuer_name ( ) — return a Name object for the subject or issuer name. Methods for handling Name objects are given below 👇
• is_selfsigned ( ) — returns a boolean value, true if subject and issuer name are the same. It's giving "I made myself" main character energy 🪞
• as_string ( [ FORMAT ] ) — returns the certificate as a string in the specified format. FORMAT can be one of FORMAT_PEM (the default) or FORMAT_ASN1.
• modulus ( ) — returns the modulus for an RSA public key as a string of hex digits. For DSA and EC it returns the public key instead. Other algorithms are not supported 🙈
• bit_length ( ) — returns the length of the modulus as a number of bits.
• fingerprint_md5 ( )
• fingerprint_sha1 ( )
• fingerprint_sha224 ( )
• fingerprint_sha256 ( )
• fingerprint_sha384 ( )
• fingerprint_sha512 ( ) — returns the specified message digest for the certificate. Whole family, all slaying 💖
• checkend( OFFSET ) — given an offset in seconds, will the certificate be expired? Returns true if the certificate will be expired, false otherwise. (Yes, the logic is a little feral — read it twice, bestie 😭)
• pubkey ( ) — returns the RSA, DSA, or EC public key.
• num_extensions ( ) — returns the number of extensions in the certificate. Counting her accessories 🎀
• extension ( INDEX ) — returns the Extension specified by the integer INDEX. Methods for handling Extension objects are given below 👇
• extensions_by_oid ( )
• extensions_by_name ( )
• extensions_by_long_name ( ) — return a hash of Extensions indexed by OID or name. Take your pick, queen 🌸
• has_extension_oid ( OID ) — returns true if the certificate has the extension specified by OID.
• subjectaltname ( ) — uses Convert::ASN1 to extract the Subject Alternative Names from the X509 object. subjectaltname ( ) returns an array of objects, each object representing a SAN.

These could be of the following types (as defined in the embedded ASN.1 schema):

• rfc822Name — email address (IA5String)
• dNSName — DNS hostname (IA5String)
• x400Address — X.400 address (ANY)
• directoryName — Distinguished Name (RDNSequence)
• ediPartyName — EDI party name (EDIPartyName)
• uniformResourceIdentifier — URI (IA5String)
• iPAddress — IP address (OCTET STRING; 4 bytes IPv4, 16 bytes IPv6)
• registeredID — OID (OBJECT IDENTIFIER)

⚠️ Note: otherName (tag [0] in RFC 5280) is not implemented and will never appear in the output. She simply doesn't know her, periodt 💀

    [
        {
            'rfc822Name' => 'altuser@mpi-sws.org'
        },
        {
            'rfc822Name' => 'user@mpi-sws.org'
        },
    ]

🎀 X509::Extension METHODS 🎀

• critical ( ) — returns a value indicating if the extension is critical or not. FIXME: the value is an ASN.1 BOOLEAN value. (She's aware, she's working on it 🙈)
• object ( ) — returns the ObjectID of the extension. Methods for handling ObjectID objects are given below 👇
• value ( ) — returns the value of the extension as an asn1parse(1) style hex dump.
• as_string ( ) — returns a human-readable version of the extension as formatted by X509V3_EXT_print. Heads up: this returns an empty string for OIDs with unknown ASN.1 encodings 😭
• basicC ( TYPE ) — returns the value of a basicConstraints field. TYPE must be ca (returns 1 if the certificate is a CA, 0 otherwise) or pathlen (returns the path length constraint, or 0 if absent).

🚨 This one throws if the basicConstraints extension DER cannot be parsed. Callers processing certificates from untrusted sources should wrap this call in eval {} — fr fr, do it: perl my $is_ca = eval { $ext->basicC('ca') } // 0;

• ia5string ( ) — returns the value of an IA5String extension (e.g. nsComment) as a string. Returns an empty string if the extension DER cannot be parsed.
• bit_string ( ) — returns the bit-string value of a key usage or Netscape certificate type extension as a string of 0/1 characters. Returns an empty string if the extension DER cannot be parsed.
• auth_att ( ) — returns 1 if the Authority Key Identifier extension contains a keyIdentifier field, 0 otherwise. Returns 0 if the extension DER cannot be parsed.
• keyid_data ( ) — returns the key identifier octets from a subjectKeyIdentifier or authorityKeyIdentifier extension as a binary string. Returns an empty string if the extension DER cannot be parsed or if the optional keyIdentifier field is absent.
• extendedKeyUsage ( ) — returns the extended key usage OIDs as a space-separated string of short names (e.g. serverAuth clientAuth). OIDs with no registered short name are silently omitted. Returns an empty string if the extension DER cannot be parsed. She's quiet about the ones she doesn't know 🤫

💜 X509::ObjectID METHODS 💜

• name ( ) — returns the long name of the object as a string.
• oid ( ) — returns the numeric dot-separated form of the object identifier as a string.

🦋 X509::Name METHODS 🦋

• as_string ( ) — returns a string representation of the Name.
• entries ( ) — returns an array of Name_Entry objects. Methods for handling Name_Entry objects are given below 👇
• has_entry ( TYPE [ LASTPOS ] )
• has_long_entry ( TYPE [ LASTPOS ] )
• has_oid_entry ( TYPE [ LASTPOS ] ) — returns true if a name has an entry of the specified TYPE. Depending on the function, TYPE may be in the short form (e.g. CN), long form (commonName) or OID (2.5.4.3). If LASTPOS is specified, the search starts from that index rather than from the beginning. Skipping ahead, we stan 💅
• get_index_by_type ( TYPE [ LASTPOS ] )
• get_index_by_long_type ( TYPE [ LASTPOS ] )
• get_index_by_oid_type ( TYPE [ LASTPOS ] ) — returns the index of an entry of the specified TYPE in a name. Depending on the function, TYPE may be in the short form (e.g. CN), long form (commonName) or OID (2.5.4.3). If LASTPOS is specified, the search starts from that index rather than from the beginning.
• get_entry_by_type ( TYPE [ LASTPOS ] )
• get_entry_by_long_type ( TYPE [ LASTPOS ] ) — these methods work similarly to get_index_by_* but return the Name_Entry rather than the index. Same search, better gift wrap 🎁

🌟 X509::Name_Entry METHODS 🌟

• as_string ( [ LONG ] ) — returns a string representation of the Name_Entry of the form typeName=Value. If LONG is 1, the long form of the type is used.
• type ( [ LONG ] ) — returns a string representation of the type of the Name_Entry. If LONG is 1, the long form of the type is used.
• value ( ) — returns a string representation of the value of the Name_Entry.
• is_printableString ( )
• is_ia5string ( )
• is_utf8string ( )
• is_asn1_type ( [ASN1_TYPE] ) — return true if the Name_Entry value is of the specified type. The value of ASN1_TYPE should be as listed in OpenSSL's asn1.h 📖

---

🫶 ISSUE REPORTING 🫶

Please report any bugs or feature requests using GitHub. She reads her DMs, bestie 💌

• GitHub Issues — https://github.com/dsully/perl-crypt-openssl-x509/issues (link split across lines in the original as https://github.com/dsully/perl-crypt-openssl- / x509/issues — same URL, no cap 🦋)

🌈 SEE ALSO 🌈

Okay bestie, if you're in your “I need more lore” era, these are the links to bookmark:

• OpenSSL website — https://www.openssl.org/ 🫶
• Crypt::OpenSSL::RSA — https://metacpan.org/pod/Crypt::OpenSSL::RSA 🔥
• Crypt::OpenSSL::Bignum — https://metacpan.org/pod/Crypt::OpenSSL::Bignum ✨
• Crypt::OpenSSL::Guess — https://metacpan.org/pod/Crypt::OpenSSL::Guess 🦋

---

👑 AUTHOR 👑

The people behind the page, no cap:

• Dan Sully — original author 💖
• Jonas Brømsø — current maintainer ✨
• Please see the "ACKNOWLEDGEMENTS" section for a list of contributors. 🫶

---

🎀 ACKNOWLEDGEMENTS 🎀

In alphabetical order, because we stay organized. Shoutout to every single one of these icons:

• @eserte
• @kmx
• @stphnlyd
• Ashley Hindmarsh @bestscarper
• Bernhard M. Wiedemann @bmwiedemann
• Brad Davidson @brandond
• Daniel Kahn Gillmor
• Daniel Risacher
• David O'Callaghan
• David Steinbrunner @dsteinbrunner
• dsteinwand
• Florian Schlichting @fschlich
• IKEDA Soji @ikedas
• James Hunt @jhunt
• James Rouzier @jrouzierinverse
• Johanna @0xxon
• Jonas Brømsø @jonasbn
• Louise Doran
• Maxime Besson @maxbes
• Michael McClimon @mmcclimon
• Michal Josef Špaček @michal-josef-spacek
• Neil Bowers @neilb
• Nicholas Harteau
• Otmar Lendl
• Patrick C. @errror
• Patrick Cernko
• Petr Pisar @ppisar
• pi-rho
• Salvador Fandiño @salva
• Sebastian Andrzej Siewior
• Sho Nakatani @laysakura
• Shoichi Kaji @skaji
• Timothy Legge @timlegge
• Todd Rinaldo @toddr
• Uli Scholler

---

💜 COPYRIGHT AND LICENSE 💜

Copyright 2004 by Dan Sully

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

---

💖 That's the whole page, bestie! It's from perl v5.42.3, dated 2026-08-20, and it's the X509(3pm) page. Byeee! 💅✨