X509_GET0_SIGNATURE(3SSL)

📦

version 4.0.3 · 13 versions

✨ X509_GET0_SIGNATURE ✨

okay bestie, gather round, because today we're talking about signature information — all the little receipts a certificate carries about how it got signed 💅 this is the OpenSSL family of functions that peek at, set, and generally vibe check the signature bits inside X509 certs, cert requests, CRLs and attribute certs. she does a lot. she's booked and busy. 🎀

Meet the cast, because there's like fifteen of them and they all show up to the function party:

X509_get0_signature
X509_REQ_set0_signature
X509_REQ_set1_signature_algo
X509_get_signature_nid
X509_get0_tbs_sigalg
X509_REQ_get0_signature
X509_REQ_get_signature_nid
X509_CRL_get0_signature
X509_CRL_get_signature_nid
X509_CRL_get0_tbs_sigalg
X509_get_signature_info
X509_SIG_INFO_get
X509_SIG_INFO_set
X509_ACERT_get0_signature
X509_ACERT_get0_info_sigalg
X509_ACERT_get_signature_nid

group chat name: signature information 🦋

💖 SYNOPSIS 💖

#include <openssl/x509.h>

void X509_get0_signature(const ASN1_BIT_STRING **psig,
                         const X509_ALGOR **palg,
                         const X509 *x);
void X509_REQ_set0_signature(X509_REQ *req, ASN1_BIT_STRING *psig);
int X509_REQ_set1_signature_algo(X509_REQ *req, X509_ALGOR *palg);
int X509_get_signature_nid(const X509 *x);
const X509_ALGOR *X509_get0_tbs_sigalg(const X509 *x);

void X509_REQ_get0_signature(const X509_REQ *crl,
                             const ASN1_BIT_STRING **psig,
                             const X509_ALGOR **palg);
int X509_REQ_get_signature_nid(const X509_REQ *crl);

const X509_ALGOR *X509_ACERT_get0_info_sigalg(const X509_ACERT *x);

void X509_CRL_get0_signature(const X509_CRL *crl,
                             const ASN1_BIT_STRING **psig,
                             const X509_ALGOR **palg);
int X509_CRL_get_signature_nid(const X509_CRL *crl);
const X509_ALGOR *X509_CRL_get0_tbs_sigalg(const X509_crl *crl);

int X509_get_signature_info(const X509 *x, int *mdnid, int *pknid, int *secbits,
                            uint32_t *flags);

int X509_SIG_INFO_get(const X509_SIG_INFO *siginf, int *mdnid, int *pknid,
                     int *secbits, uint32_t *flags);
void X509_SIG_INFO_set(X509_SIG_INFO *siginf, int mdnid, int pknid,
                       int secbits, uint32_t flags);

#include <openssl/x509_acert.h>

void X509_ACERT_get0_signature(const X509_ACERT *x,
                               const ASN1_BIT_STRING **psig,
                               const X509_ALGOR **palg);
int X509_ACERT_get_signature_nid(const X509_ACERT *x);
=head1 DESCRIPTION

(yes that last line is literally in the original, i'm not making it up, we keep the artifacts bestie 🙈)

🌸 DESCRIPTION 🌸

X509_get0_signature() is the icon herself: she sets *psig to the signature of x, and *palg to the signature algorithm of x. BIG WARNING THOUGH — the values she hands back are internal pointers, and they MUST NOT be freed up after the call. do not. i am begging. put the free() down. 🫶

X509_set0_signature() and X509_REQ_set1_signature_algo() are the equivalent setters for those two values that X509_get0_signature() gives you. matching set, slay.

X509_get0_tbs_sigalg() and X509_CRL_get0_tbs_sigalg() return the signature algorithm that lives in the signed portion of the certificate or CRL. the signed part. the part that's actually protected. iykyk.

X509_get_signature_nid() returns the NID corresponding to the signature algorithm of x. one NID, that's it, that's the whole job. 💅

X509_REQ_get0_signature(), X509_REQ_get_signature_nid(), X509_CRL_get0_signature() and X509_CRL_get_signature_nid() do the exact same little dance, but for certificate requests and CRLs. same energy, different object.

X509_get_signature_info() pulls up the full dossier on certificate x's signature:

the NID of the signing digest goes to *mdnid 🍓
the public key algorithm goes to *pknid 🔑
the effective security bits go to *secbits 🔐
the flag details go to *flags 🚩

and the best part? you can set <highlight>any</highlight> of those parameters to NULL if you don't need that info. no pressure, no forced commitments, we love a low-maintenance API 🎀

X509_SIG_INFO_get() and X509_SIG_INFO_set() get and set information about a signature inside an X509_SIG_INFO structure. real talk though: these two are only used by implementations of algorithms that need to set custom signature information. like, most applications will literally never need to call them. if you're calling them, you already know why. main character behavior, but a niche one. ✨

X509_ACERT_get0_signature(), X509_ACERT_get_signature_nid() and X509_ACERT_get0_info_sigalg() do the same thing again for attribute certificates. trio behavior 💜

🔥 NOTES 🔥

These functions give you lower level access to signatures in certificates. when do you want that? when your application wants to analyse or generate a signature in a form where X509_sign() et al is not appropriate — for example a non standard or unsupported format. Yeah. Sometimes the normal path just doesn't fit and you gotta go direct. it's giving DIY. 🔧

And here's the part that matters, bestie, listen up: the security bits that X509_get_signature_info() returns refer to information available from the certificate signature — stuff like the signing digest. But in some cases the actual security of the signature is less than that, because the signing key itself is less secure.

The example. Remember the example. A certificate signed using SHA-512 and a 1024 bit RSA key. digest looking snatched, key looking... not. 😭 the numbers lie to you sometimes.

👑 RETURN VALUES 👑

X509_get_signature_nid(), X509_REQ_get_signature_nid() and X509_CRL_get_signature_nid() — return a NID ⭐
X509_get0_signature(), X509_REQ_get0_signature() and X509_CRL_get0_signature() — do not return values. they're void. they hand you stuff through pointers. silent but powerful. 💅
X509_get_signature_info() — returns 1 if the signature information returned is valid, or 0 if the information is not available (e.g. unknown algorithms or malformed parameters). 🍓
X509_REQ_set1_signature_algo() — returns 0 on success; or 1 on an error (e.g. null ALGO pointer). yes bestie you read that right, it's inverted, that's just how she is, that's the API's whole brand. 0 good, 1 bad, no cap. 💀
X509_REQ_set0_signature — does not return an error value. she simply does not report back. 🙈

the whole friend group 💜 go read them, they're all lore-relevant.

🦋 HISTORY 🦋

a lil timeline, because this API's been growing:

X509_get0_signature() and X509_get_signature_nid() — added in OpenSSL 1.0.2 🍼
X509_REQ_get0_signature(), X509_REQ_get_signature_nid(), X509_CRL_get0_signature() and X509_CRL_get_signature_nid() — added in OpenSSL 1.1.0
X509_REQ_set0_signature() and X509_REQ_set1_signature_algo() — added in OpenSSL 1.1.1e
X509_ACERT_get0_signature(), X509_ACERT_get0_info_sigalg() and X509_ACERT_get_signature_nid() — added in OpenSSL 3.4 ✨ (fresh drop)
X509_CRL_get0_tbs_sigalg() — added in OpenSSL 3.6 🆕 (newest baby in the lineup)

glow ups across the decades, we love to see it.

💜 COPYRIGHT 💜

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

and that's the page, bestie!! 🎀 stay safe out there, don't free the internal pointers, respect the inverted return codes, and remember that a SHA-512 digest on a weak key is just vibes. this was page X509_GET0_SIGNATURE(3SSL) from the OpenSSL fam, version 4.0.3, dated 2026-09-29. periodt. 💅✨🫶

📦 where this page comes from

ubuntu stonking: libssl-doc 4.0.3-1ubuntu1 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms

X509_GET0_SIGNATURE(3SSL)