X509_CHECK_ISSUED(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

💖 X509_CHECK_ISSUED(3SSL) 💖

okay bestie, welcome to the OpenSSL x509v3 girlies' corner!! today we're talking about X509_check_issued and X509_check_akid — they're helper functions that check whether one certificate is a potential issuer of another certificate. it's giving "are u my mom or not" energy, and honestly? iconic. ✨

✨ SYNOPSIS ✨

#include <openssl/x509v3.h>

int X509_check_issued(const X509 *issuer, const X509 *subject);
int X509_check_akid(const X509 *issuer, const AUTHORITY_KEYID *akid);

🌸 DESCRIPTION 🌸

X509_check_issued() — the main character 👑

X509_check_issued() checks if certificate subject was apparently issued using (CA) certificate issuer. no cap, that's the whole vibe. here's the receipts it goes through:

  • it checks if the issuer field of subject equals the subject field of issuer. matching besties fr fr 💅
  • moreover, it compares — using X509_check_akid() — all sub-fields of the authorityKeyIdentifier extension of subject, as far as present, with the respective subjectKeyIdentifier, serial number, and issuer fields of issuer, as far as present.
  • it also checks if the subject signature algorithm matches the issuer public key algorithm 🦋
  • and it checks if any keyUsage field given in issuer allows certificate signing ✍️
⚠️ real talk tho: it does NOT actually check the certificate signature. like at all. do not come for it. and also: an error is returned if the issuer or the subject are incomplete certificates. so make sure they're fully formed before you show up, okay?? 💀

X509_check_akid() — the low-level understudy 🌈

X509_check_akid() is a more low-level function. it assumes that various internal fields of issuer have already been filled in, for instance by calling X509_check_purpose(3) with its id parameter being -1. (yes bestie, -1. that's the magic number, don't ask 💫)

it checks whether the fields of the subject certificate's authority key identifier akid match the corresponding fields of the issuer certificate.

in more detail: it returns X509_V_OK if akid is NULL (because this means no restriction, we love a chill queen 🎀) or all the following conditions are met:

  • if akid has the "keyIdentifier" field, its value matches the subjectKeyIdentifier (SKID) extension of issuer if present,
  • if akid has the "authorityCertSerialNumber" field, its value equals the serial number of the issuer certificate, and
  • if akid has the "authorityCertIssuer" field and its "GeneralNames" include at least one "directoryName", the first such name equals the "issuer" field of the issuer certificate.

periodt. all three, or it's a no from me 🙅‍♀️

🌟 RETURN VALUES 🌟

X509_check_issued() and X509_check_akid() return X509_V_OK if all checks are successful, or some X509_V_ERR* constant indicating why the issuer does not match. so if you get something other than X509_V_OK, that constant is literally telling u exactly what went wrong. read it. it's yapping for a reason 🗣️💜

🔥 SEE ALSO 🔥

(every single one of these is a banger, go read them when u get a sec 🫶)

📜 HISTORY 📜

X509_check_issued() has had its arguments altered to be const in OpenSSL 4.0. glow-up achieved, structure preserved, obsessed 😌✨

Copyright 2015-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page bestie!! this was X509_CHECK_ISSUED(3SSL) from OpenSSL version 4.0.3, dated 2026-09-29 — mwah, go check some issuers, u got this 💖🦋🎀

📦 where this page comes from