X509_GET_VERSION(3SSL)

💖 X509_GET_VERSION 💖

okay so bestie, welcome to X509_GET_VERSION(3SSL) — the OpenSSL page about peeking at (and setting) the version field on certs, cert requests, and CRLs. it's giving "small functions, big consequences". let's get into it 🎀

---

✨ NAME ✨

X509_get_version, X509_set_version, X509_REQ_get_version, X509_REQ_set_version, X509_ACERT_get_version, X509_ACERT_set_version, X509_CRL_get_version, X509_CRL_set_version — get or set certificate, certificate request or CRL version 💅

---

🌈 SYNOPSIS 🌈

#include <openssl/x509.h>

long X509_get_version(const X509 *x);
int X509_set_version(X509 *x, long version);

long X509_REQ_get_version(const X509_REQ *req);
int X509_REQ_set_version(X509_REQ *x, long version);

long X509_CRL_get_version(const X509_CRL *crl);
int X509_CRL_set_version(X509_CRL *x, long version);

#include <openssl/x509_acert.h>

int X509_ACERT_set_version(X509_ACERT *x, long version);
long X509_ACERT_get_version(const X509_ACERT *x);

---

🦋 DESCRIPTION 🦋

X509_get_version() returns the numerical value of the version field of certificate x. those numbers line up with the constants X509_VERSION_1, X509_VERSION_2, and X509_VERSION_3.

⚠️ okay this is the part everyone trips over, so listen up: the values of these constants are defined by standards (X.509 et al) to be one less than the certificate version. so X509_VERSION_3 has value 2 and X509_VERSION_1 has value 0. yes, it's unhinged. no, you can't fix it. it's been like this since forever 💀

X509_set_version() sets the numerical value of the version field of certificate x to version.

similarly X509_REQ_get_version(), X509_REQ_set_version(), X509_ACERT_get_version(), X509_ACERT_set_version(), X509_CRL_get_version() and X509_CRL_set_version() get and set the version number of certificate requests and CRLs. they use the constants X509_REQ_VERSION_1, X509_ACERT_VERSION_2, X509_CRL_VERSION_1, and X509_CRL_VERSION_2 👑

---

📝 NOTES 📝

the version field of certificates, certificate requests and CRLs has a DEFAULT value of v1(0) — meaning the field should be omitted for version 1. and the good news? these functions handle all of that transparently for you. no extra work, no drama, just vibes ✨

---

🫶 RETURN VALUES 🫶

X509_get_version(), X509_REQ_get_version() and X509_CRL_get_version() return the numerical value of the version field.

X509_set_version(), X509_REQ_set_version() and X509_CRL_set_version() return 1 for success and 0 for failure. that's it, that's the whole range, she's simple and she knows it 💅

---

👀 SEE ALSO 👀

• d2i_X509(3)
• ERR_get_error(3)
• X509_CRL_get0_by_serial(3)
• X509_get0_signature(3)
• X509_get_ext_d2i(3)
• X509_get_extension_flags(3)
• X509_get_pubkey(3)
• X509_get_subject_name(3)
• X509_NAME_add_entry_by_txt(3)
• X509_NAME_ENTRY_get_object(3)
• X509_NAME_get_index_by_NID(3)
• X509_NAME_print_ex(3)
• X509_new(3)
• X509_sign(3)
• X509V3_get_d2i(3)
• X509_verify_cert(3)

---

📜 HISTORY 📜

X509_get_version(), X509_REQ_get_version() and X509_CRL_get_version() are functions in OpenSSL 1.1.0 — in previous versions they were macros. glow-up fr fr ⭐

X509_ACERT_get_version(), X509_ACERT_set_version() were added in OpenSSL 3.4. new girls on the block 🧚

---

💜 COPYRIGHT 💜

Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie!! 🥳 no cap, you now know more about X.509 version numbers than 99% of the internet. this was X509_GET_VERSION(3SSL) from the OpenSSL crew, version 4.0.3, dated 2026-09-29 — go forth and version responsibly, mwah 💖🌸💅