X509_CRL_GET0_BY_SERIAL(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

💅 X509_CRL_GET0_BY_SERIAL(3SSL) 💅

okay bestie, so this is a page from the OpenSSL manual, section 3SSL, and it's all about CRL revoked entry utility functions. if you've ever needed to peek inside a Certificate Revocation List and go "wait, is THIS serial in there??" — girl, this is your page. 🎀

✨ NAME ✨

X509_CRL_get0_by_serial, X509_CRL_get0_by_cert, X509_CRL_get_REVOKED, X509_REVOKED_get0_serialNumber, X509_REVOKED_get0_revocationDate, X509_REVOKED_set_serialNumber, X509_REVOKED_set_revocationDate, X509_CRL_add0_revoked, X509_CRL_sort — the whole CRL revoked entry utility functions squad 🫶

🌸 SYNOPSIS 🌸

#include <openssl/x509.h>

int X509_CRL_get0_by_serial(X509_CRL *crl,
                            X509_REVOKED **ret, const ASN1_INTEGER *serial);
int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, const X509 *x);

STACK_OF(X509_REVOKED) *X509_CRL_get_REVOKED(const X509_CRL *crl);

const ASN1_INTEGER *X509_REVOKED_get0_serialNumber(const X509_REVOKED *r);
const ASN1_TIME *X509_REVOKED_get0_revocationDate(const X509_REVOKED *r);

int X509_REVOKED_set_serialNumber(X509_REVOKED *r, ASN1_INTEGER *serial);
int X509_REVOKED_set_revocationDate(X509_REVOKED *r, ASN1_TIME *tm);

int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev);

int X509_CRL_sort(X509_CRL *crl);

✨ DESCRIPTION ✨

X509_CRL_get0_by_serial() — it's out here trying to find a revoked entry inside crl that matches the serial number serial. and if it wins? it sets *ret to the internal pointer of the matching entry. ⚠️ and because of that, *ret MUST NOT be freed after the call. like, do not touch it. it's not yours. 🙈

X509_CRL_get0_by_cert() — literally the same energy as X509_get0_by_serial() except it hunts for the revoked entry using the serial number of certificate x. same vibes, different input bestie. 💅

X509_CRL_get_REVOKED() — hands you an internal pointer to a STACK of all the revoked entries for crl. the whole group chat. 👑

X509_REVOKED_get0_serialNumber() — returns an internal pointer to the serial number of r. 🍓

X509_REVOKED_get0_revocationDate() — returns an internal pointer to the revocation date of r. ⭐

X509_REVOKED_set_serialNumber() — sets the serial number of r to serial. heads up: the serial pointer you pass in is not used internally, so you should free it after use. it did its job, let it go. 🦋

X509_REVOKED_set_revocationDate() — sets the revocation date of r to tm. same deal: the tm pointer is not used internally, so free it after use. bye girl 💜

X509_CRL_add0_revoked() — appends revoked entry rev to CRL crl. ⚠️ and the rev pointer IS used internally, so it MUST NOT be freed after the call: it gets freed when the parent CRL is freed. it's adopted now, it lives there, don't come for it. 😭

X509_CRL_sort() — sorts the revoked entries of crl into ascending serial number order. organizing the whole thing, main character behavior honestly. ✨

📝 NOTES 📝

applications can figure out the number of revoked entries that X509_CRL_get_REVOKED() gave back by using sk_X509_REVOKED_num(), and then examine each one in turn using sk_X509_REVOKED_value(). one by one, no skipping. 🧚

🌈 RETURN VALUES 🌈

  • X509_CRL_get0_by_serial() and X509_CRL_get0_by_cert() return 0 for failure, 1 on success — except if the revoked entry has the reason "removeFromCRL" (8), in which case 2 is returned. yes bestie, a secret third number. 💀
  • X509_CRL_get_REVOKED() returns a STACK of revoked entries.
  • X509_REVOKED_get0_serialNumber() returns an ASN1_INTEGER structure.
  • X509_REVOKED_get0_revocationDate() returns an ASN1_TIME structure.
  • X509_REVOKED_set_serialNumber(), X509_REVOKED_set_revocationDate(), X509_CRL_add0_revoked() and X509_CRL_sort() return 1 for success and 0 for failure.

🌟 SEE ALSO 🌟

d2i_X509(3), ERR_get_error(3), X509_get0_signature(3), X509_get_ext_d2i(3), X509_get_extension_flags(3), X509_get_pubkey(3), X509_get_subject_name(3), X509_get_version(3), X509_NAME_add_entry_by_txt(3), X509_NAME_ENTRY_get_object(3), X509_NAME_get_index_by_NID(3), X509_NAME_print_ex(3), X509_new(3), X509_sign(3), X509V3_get_d2i(3), X509_verify_cert(3)

🕰️ HISTORY 🕰️

  • X509_CRL_get0_by_cert() was constified in OpenSSL 4.0.
  • X509_CRL_get_REVOKED() was constified in OpenSSL 4.0.
  • X509_CRL_get0_by_cert was constified in OpenSSL 4.0.

(yes, it says it twice-ish, that's just how the page is, i don't make the rules 🫶)

Copyright 2015-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay and that's the whole thing!! this was OpenSSL 4.0.3, dated 2026-09-29, and it's X509_CRL_GET0_BY_SERIAL(3SSL) in case you need to cite it for the group project. go forth and check those serial numbers bestie, you got this 💖✨🎀

📦 where this page comes from