X509_KEYID_SET1(3)

💅 X509_KEYID_SET1 — bestie's guide to PKCS#12 aux data ✨

okay so this is X509_KEYID_SET1(3), straight out of the Library Functions Manual, and it's literally all about storing lil extra bits of data on your X509 certs for PKCS#12 vibes. no cap. 🎀

---

🌸 NAME 🌸

X509_keyid_set1, X509_keyid_get0, X509_alias_set1, X509_alias_get0 — auxiliary certificate data for PKCS#12 🦋

---

✨ SYNOPSIS ✨

#include <openssl/x509.h>

int
X509_keyid_set1(X509 *x, const unsigned char *data, int len);

unsigned char *
X509_keyid_get0(X509 *x, int *plen);

int
X509_alias_set1(X509 *x, const unsigned char *data, int len);

unsigned char *
X509_alias_get0(X509 *x, int *plen);

---

💖 DESCRIPTION 💖

So these functions store non-standard auxiliary data in x and, like, retrieve it. that's the whole vibe. 🫶

The len bytes of data you store with X509_keyid_set1() are gonna get written to the localKeyID attribute of the PKCS#12 structure if PKCS12_create(3) gets called on x later. and the stuff you store with X509_alias_set1() goes to the friendlyName attribute. cute, right? 🎀

If data points to a NUL-terminated string, you can pass -1 as the len argument and it'll figure out len internally using strlen(3). so slay.

If you pass a NULL pointer as the data argument, the respective auxiliary data stored in x — if there is any — gets removed from x and freed. bye bestie 👋

Conversely (iconic word), PKCS12_parse(3) retrieves these attributes from a PKCS#12 structure so you can subsequently get at them with X509_keyid_get0() and X509_alias_get0(). Unless NULL is passed for the plen argument, these functions store the size of the returned buffer in bytes into *plen. 💅

heads up: after the call, the returned buffer is not necessarily NUL-terminated, but it may contain internal NUL bytes. so don't go assuming things, fr fr. 😭

API design is very incomplete; given the complexity of PKCS#12, that's probably an asset rather than a defect. (lowkey iconic of them to admit it.) The PKCS#12 standard defines many attributes that cannot be stored in X509 objects. 😬

To associate certificates with alternative names and key identifiers, X.509 certificate extensions are more commonly used than PKCS#12 attributes — for example using X509_EXTENSION_create_by_NID(3) with NID_subject_alt_name or NID_subject_key_identifier. ✨

---

🔥 RETURN VALUES 🔥

• X509_keyid_set1() and X509_alias_set1() — return 1 if data is NULL, or if the input data was successfully copied into x. return 0 if data is not NULL but could not be copied because x is NULL or memory allocation failed. 💀
• X509_keyid_get0() and X509_alias_get0() — return an internal pointer to an array of bytes, or NULL if x doesn't contain auxiliary data of the requested kind. 🙈

---

👑 SEE ALSO 👑

ASN1_STRING_set(3), X509_CERT_AUX_new(3), X509_EXTENSION_new(3), X509_new(3), X509V3_get_d2i(3) ⭐

---

🌈 HISTORY 🌈

• X509_alias_set1() and X509_alias_get0() first appeared in OpenSSL 0.9.5 and have been available since OpenBSD 2.7. 🧚
• X509_keyid_set1() first appeared in OpenSSL 0.9.6 and have been available since OpenBSD 2.9. 💜
• X509_keyid_get0() first appeared in OpenSSL 0.9.8 and have been available since OpenBSD 4.5. 🍓

---

and that's the whole page, bestie!! this one's from the Debian build, dated July 9, 2021, and it's the X509_KEYID_SET1(3) manual — go forth and store your aux data responsibly 💅✨🎀