SCT_VALIDATE(3SSL)

💅 SCT_VALIDATE (3SSL) — the OpenSSL glow-up 🌸

Okay bestie, welcome to the SCT_VALIDATE(3SSL) page. This is where we check that your Signed Certificate Timestamps (SCTs) are actually valid, no cap. 🦋

---

✨ NAME ✨

SCT_validate, SCT_LIST_validate, SCT_get_validation_status — checks Signed Certificate Timestamps (SCTs) are valid 💖

---

🎀 SYNOPSIS 🎀

#include <openssl/ct.h>

typedef enum {
    SCT_VALIDATION_STATUS_NOT_SET,
    SCT_VALIDATION_STATUS_UNKNOWN_LOG,
    SCT_VALIDATION_STATUS_VALID,
    SCT_VALIDATION_STATUS_INVALID,
    SCT_VALIDATION_STATUS_UNVERIFIED,
    SCT_VALIDATION_STATUS_UNKNOWN_VERSION
} sct_validation_status_t;

int SCT_validate(SCT *sct, const CT_POLICY_EVAL_CTX *ctx);
int SCT_LIST_validate(const STACK_OF(SCT) *scts, CT_POLICY_EVAL_CTX *ctx);
sct_validation_status_t SCT_get_validation_status(const SCT *sct);

---

💀 DESCRIPTION 💀

SCT_validate() will check that an SCT is valid, and it verifies its signature too. SCT_LIST_validate() does the exact same checks but on a whole stack of SCTs, like it's doing a vibe check on the entire group chat. 🫶

Wanna know how the checks went? Pass the SCT into SCT_get_validation_status() and it'll spill. ✨

You must hand over a CT_POLICY_EVAL_CTX that specifies these three things:

• The certificate the SCT was issued for.

Fail to provide the certificate and the validation status is gonna be SCT_VALIDATION_STATUS_UNVERIFIED. 😭

• The issuer of that certificate.

Ngl, this one is only required if the SCT was issued for a pre-certificate (see RFC 6962). But if it is required and you didn't provide it, the validation status will be SCT_VALIDATION_STATUS_UNVERIFIED.

• A CTLOG_STORE that contains the CT log that issued this SCT.

If the SCT was issued by a log that's not in this CTLOG_STORE, the validation status will be SCT_VALIDATION_STATUS_UNKNOWN_LOG. 🙈

If the SCT is of an unsupported version (only v1 is currently supported, bestie), the validation status will be SCT_VALIDATION_STATUS_UNKNOWN_VERSION.

If the SCT's signature is incorrect, its timestamp is in the future (relative to the time in CT_POLICY_EVAL_CTX), or if it's otherwise invalid, the validation status will be SCT_VALIDATION_STATUS_INVALID. 💀

And if all the checks pass? The validation status will be SCT_VALIDATION_STATUS_VALID. Slay. 👑✨

---

🧚 NOTES 🧚

A return value of 0 from SCT_LIST_validate() should not be interpreted as a failure. At a minimum, only one valid SCT may provide sufficient confidence that a certificate has been publicly logged. So one SCT doing the work is still a win, fr fr. 💜

---

🌈 RETURN VALUES 🌈

SCT_validate() returns a negative integer if an internal error occurs, 0 if the SCT fails validation, or 1 if the SCT passes validation.

SCT_LIST_validate() returns a negative integer if an internal error occurs, 0 if any of the SCTs fails validation, or 1 if they all pass validation. It's giving strict group-project energy — one person not showing up means no grade. 😤

SCT_get_validation_status() returns the validation status of the SCT. But heads up: if SCT_validate() or SCT_LIST_validate() haven't been passed that SCT yet, the returned value will be SCT_VALIDATION_STATUS_NOT_SET. That's the "we haven't even looked at this one yet" status. 🙃

---

👀 SEE ALSO 👀

• ct(7)

---

📜 HISTORY 📜

These functions were added in OpenSSL 1.1.0. So they've been iconic for a minute. ⭐

---

💖 COPYRIGHT 💖

Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

That's the whole page, bestie — go forth and validate those SCTs responsibly. 💅✨

Signing off from version 4.0.3, dated 2026-09-29, and yes this was SCT_VALIDATE(3SSL) the whole time. Mwah. 🎀🦋