X509V3_SET_CTX(3SSL)

✨ NAME ✨

X509V3_set_ctx, X509V3_set_issuer_pkey — the X.509 v3 extension generation utilities, aka the little setup besties you call before you start making extensions 💖

This page is from the OpenSSL manual, section 3SSL (library calls), and honestly? it's shorter than you think, so stay with me.

---

🌸 SYNOPSIS 🌸

#include <openssl/x509v3.h>

void X509V3_set_ctx(X509V3_CTX *ctx, X509 *issuer, X509 *subject,
                    X509_REQ *req, X509_CRL *crl, int flags);
int X509V3_set_issuer_pkey(X509V3_CTX *ctx, EVP_PKEY *pkey);

---

💅 DESCRIPTION 💅

Okay so first up: X509V3_set_ctx() is the one that fills in the basic fields of ctx (which is of type X509V3_CTX). It's handing over all the details that functions producing X509 v3 extensions might potentially need later. No cap. 🫶

Those functions may make use of fields of the certificate subject, the certification request req, or the certificate revocation list crl. Specifically:

• when constructing the subject key identifier of a certificate by computing a hash value of its public key, the public key is taken from subject or req 👑
• similarly, when constructing subject alternative names from any email addresses contained in a subject DN, that subject DN is taken from subject or req

If subject or crl is provided, issuer should point to its issuer — like, as a reference for generating the authority key identifier extension. And here's the cute twist: issuer may be the same pointer value as subject, which usually is an indication that the subject certificate is self-issued or even self-signed. 🪞 In that case, the fallback source for generating the authority key identifier extension will be taken from any value provided using X509V3_set_issuer_pkey().

Then flags — it may be 0, or it may contain:

• X509V3_CTX_TEST — which means that just the syntax of extension definitions is to be checked, without actually producing any extension. just a vibe check, no output 🔍
• X509V3_CTX_REPLACE — which means that each X.509v3 extension added as defined in some configuration section shall replace any already existing extension with the same OID. out with the old, in with the new 💅

Now X509V3_set_issuer_pkey() explicitly sets the issuer private key of the subject certificate that has been provided in ctx. You should do this in case the issuer and subject arguments to X509V3_set_ctx() have the same pointer value — because that's exactly the situation where you need fallback data for the authority key identifier extension. ✨

---

🎀 RETURN VALUES 🎀

• X509V3_set_ctx() does not return a value. it's a void girlie, she gives nothing back, she simply does
• X509V3_set_issuer_pkey() returns 1 on success and 0 on error

---

🔥 SEE ALSO 🔥

• X509_add_ext(3)

---

🌈 HISTORY 🌈

• X509V3_set_issuer_pkey() was added in OpenSSL 3.0.
• CTX_TEST was deprecated in OpenSSL 3.0; use X509V3_CTX_TEST instead. (the old name is giving legacy energy, pls upgrade 💀)

---

👑 COPYRIGHT 👑

Copyright 2015-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

okay bestie that's the whole page, you ate it, periodt 🦋 this was version 4.0.3, dated 2026-09-29, from the X509V3_SET_CTX(3SSL) manual — go set some contexts, ily 💜