X509_NAME_PRINT_EX(3SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 X509_NAME_PRINT_EX ✨

okay bestie, pull up a chair 🫶 this is the 3SSL manual page for the whole X509 name-printing fam, and honestly? it's giving "chaotic but iconic" 🌈

🌸 NAME 🌸

X509_NAME_print_ex, X509_NAME_print_ex_fp, X509_NAME_print, X509_NAME_oneline — the X509_NAME printing routines, aka the whole glow-up squad that turns a name into something you can actually read 👑

✨ SYNOPSIS ✨

#include <openssl/x509.h>

int X509_NAME_print_ex(BIO *out, const X509_NAME *nm,
                       int indent, unsigned long flags);
int X509_NAME_print_ex_fp(FILE *fp, const X509_NAME *nm,
                          int indent, unsigned long flags);
char *X509_NAME_oneline(const X509_NAME *a, char *buf, int size);
int X509_NAME_print(BIO *bp, const X509_NAME *name, int obase);

💅 DESCRIPTION 💅

  • X509_NAME_print_ex() — prints a human-readable version of nm straight into the BIO out. Every line (for the multiline formats, obvi) gets indented by indent spaces. The whole output format is extensively customisable through the flags parameter, and she ate with that 💅
  • X509_NAME_print_ex_fp() — literally identical to X509_NAME_print_ex() except the output goes to a FILE pointer fp instead. no cap, same energy, different destination 🎀
  • X509_NAME_oneline() — prints an ASCII version of a into buf. She supports multi-valued RDNs and escapes / and + characters inside values, periodt. If buf is NULL, then a buffer gets dynamically allocated and returned, and size is just ignored bestie 🙈. Otherwise, at most size bytes get written — and yes that count includes the ending '\0' — and then buf is returned.
  • X509_NAME_print() — prints out name to bp on a single line. The obase parameter is ignored and only kept around for API compatibility 😭 it's just vibing there for no reason.

🦋 NOTES 🦋

⚠️ real talk: X509_NAME_oneline() and X509_NAME_print() produce a non standard output form. They don't handle multi-character fields and they come with various quirks and inconsistencies. Their use is strongly discouraged in new applications, and they could be deprecated in a future release 💀 so like… don't build your whole personality on them, k?

ngl there are a lot of possible flags, but for most purposes XN_FLAG_ONELINE, XN_FLAG_MULTILINE or XN_FLAG_RFC2253 will suffice. iconic trio, they carry the whole set 💜

Also, as noted on the ASN1_STRING_print_ex(3) manual page: for UTF8 terminals the ASN1_STRFLGS_ESC_MSB should be unset — so for example you'd use XN_FLAG_ONELINE & ~ASN1_STRFLGS_ESC_MSB ✨

The complete set of flags supported by X509_NAME_print_ex() is listed right here:

Several options can be ored together, so mix and match like it's a build-a-bear 💖

🎀 Field separator flags

XN_FLAG_SEP_COMMA_PLUS, XN_FLAG_SEP_CPLUS_SPC, XN_FLAG_SEP_SPLUS_SPC and XN_FLAG_SEP_MULTILINE determine the field separators to use. Two distinct separators get used — one between distinct RelativeDistinguishedName components, and one between separate values in the same RDN for a multi-valued RDN. Multi-valued RDNs are currently very rare, so that second separator will hardly ever be used 🙈 lowkey forgotten.

  • XN_FLAG_SEP_COMMA_PLUS — uses comma and plus as separators.
  • XN_FLAG_SEP_CPLUS_SPC — uses comma and plus with spaces: this one's more readable than plain comma and plus, and honestly it's the nicer vibe 🌸
  • XN_FLAG_SEP_SPLUS_SPC — uses spaced semicolon and plus.
  • XN_FLAG_SEP_MULTILINE — uses spaced newline and plus respectively.

🧚 DN ordering

  • XN_FLAG_DN_REV — if set, the whole DN is printed in reversed order. flips the whole thing, main character energy 🔄

👑 Field name flags

The fields XN_FLAG_FN_SN, XN_FLAG_FN_LN, XN_FLAG_FN_OID and XN_FLAG_FN_NONE determine how a field name is displayed:

  • XN_FLAG_FN_SN — uses the short name (e.g. CN)
  • XN_FLAG_FN_LN — uses the long name (e.g. commonName)
  • XN_FLAG_FN_OID — always uses OID numerical form (normally OIDs are only used if the field name isn't recognised)
  • XN_FLAG_FN_NONE — no field name at all, mystery edition 💀

⭐ Misc flags

  • XN_FLAG_SPC_EQ — if set, spaces get placed around the '=' character separating field names and values. it's giving breathing room ✨
  • XN_FLAG_DUMP_UNKNOWN_FIELDS — if set, the encoding of unknown fields is printed instead of the values.
  • XN_FLAG_FN_ALIGN — if set, field names are padded to 20 characters: this is only of use for multiline format, so don't come for her in single-line mode 🎀

Additionally, all the options supported by ASN1_STRING_print_ex() can be used to control how each field value is displayed 🌈

💖 Preset format flags

In addition, a number of options can be set for commonly used formats:

  • XN_FLAG_RFC2253 — sets options which produce an output compatible with RFC2253. It is equivalent to:
"ASN1_STRFLGS_RFC2253 | XN_FLAG_SEP_COMMA_PLUS | XN_FLAG_DN_REV
  | XN_FLAG_FN_SN | XN_FLAG_DUMP_UNKNOWN_FIELDS"
  • XN_FLAG_ONELINE — a more readable one line format which is the same as:
"ASN1_STRFLGS_RFC2253 | ASN1_STRFLGS_ESC_QUOTE | XN_FLAG_SEP_CPLUS_SPC
  | XN_FLAG_SPC_EQ | XN_FLAG_FN_SN"
  • XN_FLAG_MULTILINE — a multiline format which is the same as:
"ASN1_STRFLGS_ESC_CTRL | ASN1_STRFLGS_ESC_MSB | XN_FLAG_SEP_MULTILINE
  | XN_FLAG_SPC_EQ | XN_FLAG_FN_LN | XN_FLAG_FN_ALIGN"
  • XN_FLAG_COMPAT — uses a format identical to X509_NAME_print(): in fact it calls X509_NAME_print() internally. she's a wrapper, your honor 🫶

🌈 RETURN VALUES 🌈

  • X509_NAME_oneline() — returns a valid string on success, or NULL on error 😭
  • X509_NAME_print() — returns 1 on success, or 0 on error.
  • X509_NAME_print_ex() and X509_NAME_print_ex_fp() — return 1 on success or 0 on error if the XN_FLAG_COMPAT is set, which is the same as X509_NAME_print(). Otherwise, it returns -1 on error or other values on success 🔥 yes the success values are "other values", we don't make the rules.

🫶 SEE ALSO 🫶

ASN1_STRING_print_ex(3)

Copyright 2002-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page bestie, you're officially fluent 💅 this was version 4.0.3, dated 2026-09-29, mwah, go print some names 🎀✨🦋

📦 where this page comes from