X509_CHECK_CA(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

💖 X509_CHECK_CA(3SSL) 💖

okay bestie, gather round, because today we're talking about a lil function from OpenSSL called X509_check_ca and honestly? she's doing the most with so little. this is straight out of the X509_CHECK_CA(3SSL) manual, and yes, the vibes are immaculate but the facts are untouched. periodt. ✨

🌸 NAME 🌸

X509_check_ca — checks if a given certificate is a CA certificate 👑

🎀 SYNOPSIS 🎀

#include <openssl/x509v3.h>

int X509_check_ca(const X509 *cert);

🦋 DESCRIPTION 🦋

so this function does a vibe check on a certificate to see if it's a CA certificate, aka a cert that's allowed to sign other certificates. like, the main character of a cert chain, yk? 🔥

one thing though — the certificate has to be a complete certificate. if it's not, you get an error back. no half-finished fits allowed, we finish the whole outfit or we don't go out. 💅

✨ RETURN VALUES ✨

bestie, the return values here are giving very specific, so let's go one by one:

  • 0 — nope, not a CA certificate. it's giving "just a regular cert" energy. 🙈
  • 1 — YES queen, it's a proper X509v3 CA certificate with the basicConstraints extension set to CA:TRUE. iconic behavior. 👑
  • 3 — it's a self-signed X509 v1 certificate. old school, still valid.
  • 4 — it's a certificate with a keyUsage extension that has the keyCertSign bit set, but literally no basicConstraints. the audacity. 😭
  • 5 — it has that outdated Netscape Certificate Type extension bragging that it's a CA certificate. retro, but it counts.
also important: this function will also return 0 on error. so a 0 might mean "not a CA" or "something went wrong" — same value, two possible storylines. 💀

and the actual tea? any nonzero value means this certificate could have been used to sign other certificates. so anything that isn't 0 is a yes. fr fr. 🫶

💜 SEE ALSO 💜

Copyright 2015-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie!! this lil rewrite is brought to you by OpenSSL 4.0.3, dated 2026-09-29 — go forth and check those CAs, you absolute icon. 🧚💖

📦 where this page comes from