X509_NAME_HASH(3)

💅 X509_NAME_HASH(3) — the Library Functions Manual page, but make it make sense 🎀

okay bestie, so this one is from the Library Functions Manual, and it's all about turning X.501 Name objects into little numeric fingerprints. six functions, two hash flavors, one very specific purpose. let's get into it ✨

---

🌸 NAME 🌸

X509_NAME_hash, X509_issuer_name_hash, X509_subject_name_hash, X509_NAME_hash_old, X509_issuer_name_hash_old, X509_subject_name_hash_old — big name energy, but what they do is literally calculate SHA-1 or MD5 hashes of X.501 Name objects 🦋

✨ SYNOPSIS ✨

#include <openssl/x509.h>

unsigned long
X509_NAME_hash(X509_NAME *name);

unsigned long
X509_issuer_name_hash(X509 *x);

unsigned long
X509_subject_name_hash(X509 *x);

unsigned long
X509_NAME_hash_old(X509_NAME *name);

unsigned long
X509_issuer_name_hash_old(X509 *x);

unsigned long
X509_subject_name_hash_old(X509 *x);

💖 DESCRIPTION 💖

So. X509_NAME_hash() takes name, hashes the DER-encoded form of it with SHA1(3), and gives you back a number. That's it, that's the whole vibe. It's for example used by X509_LOOKUP_hash_dir(3) to locate certificate files in the file system — so like, this hash is literally how the filesystem lookup finds your certs. main character behavior tbh 👑

X509_issuer_name_hash() and X509_subject_name_hash() are just wrappers around that same move, except they do it for the issuer or the subject name of x, respectively. same hash, different source field, no cap 🫶

And then X509_NAME_hash_old(), X509_issuer_name_hash_old(), and X509_subject_name_hash_old() are the variants that use MD5 instead of SHA-1. old-school, literally in the name 💀

🎀 RETURN VALUES 🎀

They return the hash value. Or 0 if an error occurs. that's the whole deal 🍓

🦋 SEE ALSO 🦋

i2d_X509_NAME(3), X509_get_subject_name(3), X509_LOOKUP_new(3), X509_NAME_digest(3), X509_NAME_new(3) — go read these too, iykyk 💜

🌈 HISTORY 🌈

okay storytime, because the timeline here is honestly kind of iconic:

• X509_subject_name_hash() first appeared in SSLeay 0.4.0
• X509_issuer_name_hash() in SSLeay 0.5.1
• X509_NAME_hash() in SSLeay 0.8.0

Then they were switched to hashing the DER representation of the name rather than an ASCII rendering in SSLeay 0.9.0 — and they've all been available since OpenBSD 2.4. glow-up era ✨

They were switched to using SHA1 instead of MD5 in OpenSSL 1.0.0 and in OpenBSD 4.9. so both of those got the upgrade at the same time, cute 🔥

X509_NAME_hash_old(), X509_issuer_name_hash_old(), and X509_subject_name_hash_old() first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9. the old variants are newer than the new ones, which is so on brand for computers 😭

---

six functions, two hash algorithms, and a whole lot of certificate-finding going on. go off bestie 💅

and that's the page!! brought to you by the Debian gang, dated July 31, 2021 — mwah, sending you the biggest kiss, stay hashing 🧚💖