SSL_GET_PEER_CERTIFICATE(3SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

✨ SSL_get_peer_certificate — bestie, let's peek at the peer's X509 💖

okay so this is literally the OpenSSL manual, 3SSL girlies, and today we're talking about three functions that all do the same little thing: hand you the X509 certificate your peer showed up with. 🎀 yes there are three of them. yes one of them is deprecated. we'll get there.

🌸 NAME 🌸

SSL_get_peer_certificate, SSL_get0_peer_certificate, SSL_get1_peer_certificate — get the X509 certificate of the peer 🦋

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

X509 *SSL_get0_peer_certificate(const SSL *ssl);
X509 *SSL_get1_peer_certificate(const SSL *ssl);

and then the messy one, the function that has been deprecated since OpenSSL 3.0, and which can be hidden entirely by defining OPENSSL_API_COMPAT with a suitable version value, see openssl_user_macros(7):

X509 *SSL_get_peer_certificate(const SSL *ssl);

💅 DESCRIPTION 💅

so. SSL_get_peer_certificate() is deprecated, bestie, i'm so sorry. it's giving "still works but we're side-eyeing it." instead you want SSL_get0_peer_certificate() or SSL_get1_peer_certificate(). 🫶

what all of these do: they return a pointer to the X509 certificate that the peer presented. that's it, that's the whole job. and if the peer did not present a certificate? you get NULL back. no cert, no vibes. 😭

👑 NOTES 👑

okay this part is important so pay attention bestie, this is the plot twist section.

because of how the protocol is defined, a TLS/SSL server will always send a certificate, if present. like, always. it's not shy. but a client will only send a certificate when it's explicitly requested to do so by the server (see SSL_CTX_set_verify(3)). the client is not sending unsolicited certs, she knows her boundaries. ✨ and if an anonymous cipher is used, no certificates are sent at all. gone. nada. 💀

⚠️ also: just because a certificate came back does not mean it tells you anything about the verification state. do not assume, do not project. use SSL_get_verify_result(3) to actually check the verification state. periodt.

now the diff between the 0 and the 1, which is the entire reason both exist:

  • the reference count of the X509 object returned by SSL_get1_peer_certificate() is incremented by one, so it will not be destroyed when the session containing the peer certificate is freed. because of that, you must explicitly free the X509 object using X509_free(). you borrowed it, you return it. 💖
  • the reference count of the X509 object returned by SSL_get0_peer_certificate() is not incremented, and it must not be freed. hands off, that one's not yours to destroy. 🙈

and one last thing: SSL_get_peer_certificate() is an alias of SSL_get1_peer_certificate(). so if you were wondering which one the old girl maps to — it's the one you have to free yourself. iykyk. 💅

🌈 RETURN VALUES 🌈

two possible outcomes, and we love a short list:

  • NULL — no certificate was presented by the peer, or no connection was established. it's giving "nothing to see here." 💀
  • Pointer to an X509 certificate — the return value points to the certificate presented by the peer. slay. 👑

🦋 SEE ALSO 🦋

⭐ HISTORY ⭐

SSL_get0_peer_certificate() and SSL_get1_peer_certificate() were added in 3.0.0. SSL_get_peer_certificate() was deprecated in 3.0.0. glow up at 3.0.0 for two of them, glow down for the third. 😭

Copyright 2000-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page bestie!! this was the OpenSSL 3SSL manual, version 4.0.3, dated 2026-09-29 — literally set your calendar reminders, and go free your SSL_get1_peer_certificate() result with X509_free() or i will know. mwah. 💖💅✨🫶

📦 where this page comes from