EVP_PKEY_GET_ATTR(3SSL)

💖 EVP_PKEY_GET_ATTR 💖

okay bestie, welcome to the 3SSL manual, straight from the OpenSSL world ✨ this is where we keep X509_ATTRIBUTE things attached to an EVP_PKEY, and ngl it's a whole little vibe. iykyk 🌸

---

✨ NAME ✨

EVP_PKEY_get_attr, EVP_PKEY_get_attr_count, EVP_PKEY_get_attr_by_NID, EVP_PKEY_get_attr_by_OBJ, EVP_PKEY_delete_attr, EVP_PKEY_add1_attr, EVP_PKEY_add1_attr_by_OBJ, EVP_PKEY_add1_attr_by_NID, EVP_PKEY_add1_attr_by_txt — the EVP_PKEY X509_ATTRIBUTE functions, aka the group chat for poking at a key's attribute list 🎀

---

🌈 SYNOPSIS 🌈

#include <openssl/x509.h>

int EVP_PKEY_get_attr_count(const EVP_PKEY *key);
int EVP_PKEY_get_attr_by_NID(const EVP_PKEY *key, int nid, int lastpos);
int EVP_PKEY_get_attr_by_OBJ(const EVP_PKEY *key, const ASN1_OBJECT *obj,
                             int lastpos);
X509_ATTRIBUTE *EVP_PKEY_get_attr(const EVP_PKEY *key, int loc);
X509_ATTRIBUTE *EVP_PKEY_delete_attr(EVP_PKEY *key, int loc);
int EVP_PKEY_add1_attr(EVP_PKEY *key, X509_ATTRIBUTE *attr);
int EVP_PKEY_add1_attr_by_OBJ(EVP_PKEY *key,
                              const ASN1_OBJECT *obj, int type,
                              const unsigned char *bytes, int len);
int EVP_PKEY_add1_attr_by_NID(EVP_PKEY *key,
                              int nid, int type,
                              const unsigned char *bytes, int len);
int EVP_PKEY_add1_attr_by_txt(EVP_PKEY *key,
                              const char *attrname, int type,
                              const unsigned char *bytes, int len);

---

💅 DESCRIPTION 💅

so like, these functions are used by PKCS12 — that's the whole reason they exist, no cap.

EVP_PKEY_get_attr_by_OBJ() finds the location of the first matching object obj in the key attribute list, and the search starts at the position after lastpos. 🦋 if what comes back is positive, you can hand it to the next EVP_PKEY_get_attr_by_OBJ() call as the value of lastpos and just keep iterating through the rest of the attributes — it's giving little cursor energy honestly. on the very first call you can set lastpos to any negative value to start searching from the start of the attribute list. periodt.

EVP_PKEY_get_attr_by_NID() is literally the same thing as EVP_PKEY_get_attr_by_OBJ() except it passes the numerical identifier (NID) nid associated with the object instead. 🌸 see <openssl/obj_mac.h> for a list of NID_*.

EVP_PKEY_get_attr() returns the X509_ATTRIBUTE object sitting at index loc in the key attribute list. loc should be in the range from 0 to EVP_PKEY_get_attr_count() - 1. 💖

EVP_PKEY_delete_attr() removes the X509_ATTRIBUTE object at index loc in the key attribute list. bye bye 👋

EVP_PKEY_add1_attr() pushes a copy of the X509_ATTRIBUTE object you passed in to the key attribute list, and a new key attribute list gets created if it's required. an error occurs if either attr is NULL, or the attribute already exists. 😭 (yes, existing attributes are not it, sorry)

EVP_PKEY_add1_attr_by_OBJ() creates a new X509_ATTRIBUTE using X509_ATTRIBUTE_set1_object() and X509_ATTRIBUTE_set1_data() to assign a new obj with type type and data bytes of length len, and then pushes it to the key object's attribute list. if obj already exists in the attribute list then an error occurs. 💀

EVP_PKEY_add1_attr_by_NID() is similar to EVP_PKEY_add1_attr_by_OBJ() except that it passes the numerical identifier (NID) nid associated with the object. see <openssl/obj_mac.h> for a list of NID_*. ⭐

EVP_PKEY_add1_attr_by_txt() is similar to EVP_PKEY_add1_attr_by_OBJ() except that it passes a name attrname associated with the object. see <openssl/obj_mac.h> for a list of SN_* names. 🎀

---

👑 RETURN VALUES 👑

EVP_PKEY_get_attr_count() returns the number of attributes in the key object attribute list, or -1 if the attribute list is NULL. 💜

EVP_PKEY_get_attr_by_OBJ() returns -1 if either the list is empty OR the object is not found, otherwise it returns the location of the object in the list. 🔥

EVP_PKEY_get_attr_by_NID() is similar to EVP_PKEY_get_attr_by_OBJ(), except that it returns -2 if the nid is not known by OpenSSL. 😳

EVP_PKEY_get_attr() returns either a X509_ATTRIBUTE or NULL if there is a error.

EVP_PKEY_delete_attr() returns either the removed X509_ATTRIBUTE or NULL if there is a error.

EVP_PKEY_add1_attr(), EVP_PKEY_add1_attr_by_OBJ(), EVP_PKEY_add1_attr_by_NID() and EVP_PKEY_add1_attr_by_txt() return 1 on success or 0 otherwise. that's the whole yes/no situation bestie ✨

---

🧚 NOTES 🧚

A EVP_PKEY object's attribute list is initially NULL. All the above functions listed will return an error unless EVP_PKEY_add1_attr() is called. All functions listed assume that the key is not NULL. 🙈

so yeah — no list, no luck, you gotta bootstrap it with EVP_PKEY_add1_attr() first. main character setup step fr fr.

---

🫶 SEE ALSO 🫶

• X509_ATTRIBUTE(3)

---

📜 COPYRIGHT 📜

Copyright 2023-2024 The OpenSSL Project Authors. All Rights Reserved. 💖

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the page, bestie 🎀 this was version 4.0.3, dated 2026-09-29, of the OpenSSL EVP_PKEY_GET_ATTR(3SSL) manual. slay, stay hydrated, and always check for NULL 💅✨