X509_ADD_CERT(3SSL)

💖 X509_ADD_CERT(3SSL) 💖

okay bestie, welcome to the OpenSSL manual page for X509_add_cert and X509_add_certs — the X509 certificate list addition functions. yes, the manual name is 3SSL, and yes, we're gonna get into it. grab a strawberry 🍓

---

✨ NAME ✨

X509_add_cert, X509_add_certs — X509 certificate list addition functions 🎀

---

🌸 SYNOPSIS 🌸

#include <openssl/x509.h>

int X509_add_cert(STACK_OF(X509) *sk, const X509 *cert, int flags);
int X509_add_certs(STACK_OF(X509) *sk, const STACK_OF(X509) *certs, int flags);

---

🦋 DESCRIPTION 🦋

X509_add_cert() adds a certificate cert to the given list sk. bestie, it is an error for the cert argument to be NULL. like, not a vibe. don't do it. 💀

X509_add_certs() adds a list of certificate certs to the given list sk. the certs argument may be NULL, which implies no effect — it's giving "nothing happens, and that's fine". it does not modify the list certs, but in case the X509_ADD_FLAG_UP_REF flag (described below, keep reading 🫶) is set, the reference counters of those of its members added to sk are increased.

both these functions have a flags parameter, which is used to control details of the operation.

the value X509_ADD_FLAG_DEFAULT, which equals 0, means no special semantics. it's the default default. iconic behavior honestly.

if X509_ADD_FLAG_UP_REF is set then the reference counts of those certificates added successfully are increased. 🔥

if X509_ADD_FLAG_PREPEND is set then the certificates are prepended to sk. by default they are appended to sk. in both cases the original order of the added certificates is preserved. no shuffling, no chaos, we respect the queue. 💅

if X509_ADD_FLAG_NO_DUP is set then certificates already contained in sk, which is determined using X509_cmp(3), are ignored. not me checking for dupes before adding to the group chat 🙈

if X509_ADD_FLAG_NO_SS is set then certificates that are marked self-signed, which is determined using X509_self_signed(3), are ignored. main character syndrome certificates? filtered. 👑

---

👑 RETURN VALUES 👑

both functions return 1 for success and 0 for failure. that's it, that's the whole range. binary slay. ✨

---

💜 NOTES 💜

if X509_add_certs() is used with the flags X509_ADD_FLAG_NO_DUP or X509_ADD_FLAG_NO_SS it is advisable to use also X509_ADD_FLAG_UP_REF because otherwise likely not for all members of the certs list the ownership is transferred to the list of certificates sk. read that again bestie, it matters. 😭

care should also be taken in case the certs argument equals sk. yes, same list. be careful, fr fr.

---

🌈 SEE ALSO 🌈

• X509_cmp(3)
• X509_self_signed(3)

---

🧚 HISTORY 🧚

the functions X509_add_cert() and X509_add_certs() were added in OpenSSL 3.0. glow up era. 💖

X509_add_cert() had its cert parameter converted to be const in OpenSSL 4.0. character development!! 🎀

---

📜 COPYRIGHT 📜

copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.

licensed under the Apache License 2.0 (the "License"). you may not use this file except in compliance with the License. you can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie — this was X509_ADD_CERT(3SSL) from OpenSSL 4.0.3, dated 2026-09-29. mwah 💅🫶