SSL_GET_CERTIFICATE(3SSL)

💖 SSL_get_certificate — bestie edition 💖

okay so this is SSL_GET_CERTIFICATE(3SSL), from the OpenSSL manuals, and we're gonna talk about SSL_get_certificate and SSL_get_privatekey, which are literally the "hey, who am I actually being rn" functions. grab a strawberry 🍓 and let's go.

✨ NAME ✨

SSL_get_certificate, SSL_get_privatekey — retrieve TLS/SSL certificate and private key. yes bestie, the actual cert and the actual key. no cap.

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

X509 *SSL_get_certificate(const SSL *s);
EVP_PKEY *SSL_get_privatekey(const SSL *s);

🌸 DESCRIPTION 🌸

SSL_get_certificate() hands you back a pointer to an X509 object — that's a certificate — and that cert is being used as the local peer's identity. it's giving "this is me, this is my face, this is who I am in this handshake." 💅

now here's the tea: you can have multiple certificates configured at once. like, a server might be holding both an RSA certificate and an ECDSA certificate. so which one does SSL_get_certificate() give you? it depends, and the rules are:

• if you call it before certificate selection has happened, it gives you the most recently added certificate — or NULL if, bestie, no certificate has been added at all 😭
• after certificate selection has happened, it gives you the certificate that got selected during the handshake — or NULL if no certificate was selected. to be clear, that NULL case happens like, for example, on a client where no client certificate is in use. totally normal, no drama.

certificate selection happens during the handshake, so heads up: if you call SSL_get_certificate() from inside any callback that fires during the handshake, what you get back depends on whether that callback runs before or after certificate selection occurs. timing is everything, iykyk ⏳

so here's a very specific, very iconic use for SSL_get_certificate(): call it inside a callback that you set with SSL_CTX_set_tlsext_status_cb(3). that callback fires after certificate selection, which means you can peek at the server's chosen certificate right there — for example, to find that certificate's OCSP responder URL so you can go get yourself an OCSP response. obsessed. 🔥

SSL_get_privatekey() gives you a pointer to the EVP_PKEY object that corresponds to the certificate returned by SSL_get_certificate() — if there is one. if there isn't, well. you know. 🌈

✨ RETURN VALUES ✨

these functions return pointers to their respective objects, or NULL if no such object is available. 🫶

and this part matters, bestie: the returned objects are owned by the SSL object. so do not free them yourself. not yours. hands off. 🙈

👀 SEE ALSO 👀

ssl(7), SSL_CTX_set_tlsext_status_cb(3)

💜 COPYRIGHT 💜

Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole thing, babe 💖 this page was served up by OpenSSL 4.0.3, dated 2026-09-29, under the name SSL_GET_CERTIFICATE(3SSL). slay, go read your certificates responsibly. 🎀✨