X509_NAME_ADD_ENTRY_BY_TXT(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

💖 X509_NAME_ADD_ENTRY_BY_TXT 💖

okay bestie, so this is the 3SSL manual page for the OpenSSL family of name-modification girlies: X509_NAME_add_entry_by_txt, X509_NAME_add_entry_by_OBJ, X509_NAME_add_entry_by_NID, X509_NAME_add_entry, and X509_NAME_delete_entry. it's giving "i need to edit an X509_NAME and i need to do it now". let's get into it 🦋

✨ NAME ✨

X509_NAME_add_entry_by_txt, X509_NAME_add_entry_by_OBJ, X509_NAME_add_entry_by_NID, X509_NAME_add_entry, X509_NAME_delete_entry — the X509_NAME modification functions, aka your little squad for adding and deleting entries 💅

🌸 SYNOPSIS 🌸

#include <openssl/x509.h>

int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
                               const unsigned char *bytes, int len, int loc, int set);

int X509_NAME_add_entry_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj, int type,
                               const unsigned char *bytes, int len, int loc, int set);

int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
                               const unsigned char *bytes, int len, int loc, int set);

int X509_NAME_add_entry(X509_NAME *name, const X509_NAME_ENTRY *ne, int loc, int set);

X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc);

🎀 DESCRIPTION 🎀

so X509_NAME_add_entry_by_txt(), X509_NAME_add_entry_by_OBJ() and X509_NAME_add_entry_by_NID() all add a field, and the only difference is how they know which field it is — by a string field, an object obj, or a NID nid, respectively. the value you're adding lives in bytes and is len long. and if len is -1? no stress, the length gets calculated internally with strlen(bytes). iconic behavior honestly 🫶

the type of the field is set by, well, type. it can be either a definition of the type of bytes (like MBSTRING_ASC) or a standard ASN1 type (like V_ASN1_IA5STRING). the new entry gets dropped into the position decided by loc and set.

X509_NAME_add_entry() adds a copy of the X509_NAME_ENTRY structure ne to name, and again the new entry lands wherever loc and set say. and because it's a copy — not a borrow, not a vibe share — you must free ne after the call. do not skip that. i'm watching. 👀

X509_NAME_delete_entry() deletes an entry from name at position loc. the deleted entry gets returned to you, and you must free it up. give it a proper send-off 💀

🌈 NOTES 🌈

using string types like MBSTRING_ASC or MBSTRING_UTF8 for the type parameter is STRONGLY recommended. it lets the internal code correctly figure out the type of the field and apply length checks according to the relevant standards. this is done using ASN1_STRING_set_by_NID().

but if you use an ASN1 type instead — no checks, no notes, no protection. the supplied data in bytes is used directly. raw. feral. 🙈

in X509_NAME_add_entry_by_txt(), the field string represents the field name using OBJ_txt2obj(field, 0).

now, the loc and set parameters determine where a new entry should be added. for almost all applications you can just set loc to -1 and set to 0. that adds a new entry to the end of name as a single valued RelativeDistinguishedName (RDN). easy. slay. ✨

loc actually determines the index where the new entry is inserted — but if it's -1, it just gets appended. periodt.

set determines how the new type is added. if it's zero, a new RDN is created.

if set is -1 or 1, it's added as a new set member to the previous or next RDN structure, respectively. that then becomes part of a multi-valued RDN (containing a set of AVAs). and because multi-valued RDNs are very rarely used, set typically will be zero. like, basically always zero bestie.

💜 RETURN VALUES 💜

X509_NAME_add_entry_by_txt(), X509_NAME_add_entry_by_OBJ(), X509_NAME_add_entry_by_NID() and X509_NAME_add_entry() return 1 for success, or 0 if an error occurred. that's it. that's the whole range.

X509_NAME_delete_entry() returns either the deleted X509_NAME_ENTRY structure, or NULL if an error occurred. 😭

🧚 EXAMPLES 🧚

let's create an X509_NAME structure. we're going for the classic:

"C=UK, O=Disorganized Organization, CN=Joe Bloggs"

and the code, in all its glory:

X509_NAME *nm;

nm = X509_NAME_new();
if (nm == NULL)
    /* Some error */
if (!X509_NAME_add_entry_by_txt(nm, "C", MBSTRING_ASC,
                                "UK", -1, -1, 0))
    /* Error */
if (!X509_NAME_add_entry_by_txt(nm, "O", MBSTRING_ASC,
                                "Disorganized Organization", -1, -1, 0))
    /* Error */
if (!X509_NAME_add_entry_by_txt(nm, "CN", MBSTRING_ASC,
                                "Joe Bloggs", -1, -1, 0))
    /* Error */

look at that. clean. the -1, -1, 0 trio is doing so much work and saying so little. main character energy fr fr 👑

💀 BUGS 💀

okay so type can still be set to V_ASN1_APP_CHOOSE to use a different algorithm to determine field types. but hear me — this form does not understand multicharacter types, performs no length checks, and can result in invalid field types. its use is strongly discouraged. like, don't. just don't. this is the red flag option, bestie 🚩

🌟 SEE ALSO 🌟

Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

aaaaand that's the whole page, no cap 💖 this was OpenSSL 4.0.3, dated 2026-09-29, and this 3SSL manual page is officially a wrap. go forth and modify your X509_NAMEs responsibly. mwah 🎀✨

📦 where this page comes from