X509_GET_PUBKEY(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

💖 X509_GET_PUBKEY ✨

okay bestie, so this is a page from the OpenSSL manual, section 3SSL, and it's all about grabbing (or setting) the public key on a certificate or a certificate request. Think of it as: how do I get the key out of this thing, and how do I put one in. 🎀

🌸 NAME 🌸

X509_get_pubkey, X509_get0_pubkey, X509_set_pubkey, X509_get_X509_PUBKEY, X509_REQ_get_pubkey, X509_REQ_get0_pubkey, X509_REQ_set_pubkey, X509_REQ_get_X509_PUBKEY — get or set certificate or certificate request public key 💅

✨ SYNOPSIS ✨

#include <openssl/x509.h>

EVP_PKEY *X509_get_pubkey(const X509 *x);
EVP_PKEY *X509_get0_pubkey(const X509 *x);
int X509_set_pubkey(X509 *x, EVP_PKEY *pkey);
const X509_PUBKEY *X509_get_X509_PUBKEY(const X509 *x);

EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req);
EVP_PKEY *X509_REQ_get0_pubkey(const X509_REQ *req);
int X509_REQ_set_pubkey(X509_REQ *req, EVP_PKEY *pkey);
X509_PUBKEY *X509_REQ_get_X509_PUBKEY(const X509_REQ *req);

🦋 DESCRIPTION 🦋

X509_get_pubkey() is the "pls decode the public key for me" girlie. It takes certificate x and attempts to decode its public key. If it works, you get the public key back as an EVP_PKEY pointer with its reference count incremented — which means 👏 you 👏 must 👏 free 👏 it 👏 after use. no cap, that's your key to clean up.

X509_get0_pubkey() is basically the same vibe, except it does not bump the reference count of the returned EVP_PKEY. So obviously you must not free it after use. it's not yours, babes. hands off. 🙈

X509_get_X509_PUBKEY() hands you an internal pointer to the X509_PUBKEY structure that encodes the certificate of x. again: the returned value must not be freed up after use. it's a peek, not a take. 👀

X509_set_pubkey() attempts to set the public key for certificate x to pkey. and guess what — pkey should be freed up after use. (yes queen, ownership rules, we love a boundaries moment.)

X509_REQ_get_pubkey(), X509_REQ_get0_pubkey(), X509_REQ_set_pubkey() and X509_REQ_get_X509_PUBKEY() are literally the same thing but they operate on the certificate request req instead. same energy, different struct. 🫶

💜 NOTES 💜

the first time a public key gets decoded, the EVP_PKEY structure gets cached inside the certificate or certificate request itself. so every call after that just returns the cached structure with its reference count incremented — purely for the performance glow-up. it's giving "already know her, don't need to re-introduce" ✨

🌈 RETURN VALUES 🌈

X509_get_pubkey(), X509_get0_pubkey(), X509_get_X509_PUBKEY(), X509_REQ_get_pubkey() and X509_REQ_get_X509_PUBKEY() return a public key, or NULL if there's no public key present in the structure, or if an error happened. 😭 (sad girl hours)

X509_set_pubkey() and X509_REQ_set_pubkey() return 1 for success and 0 for failure. binary. iconic. periodt.

🎀 SEE ALSO 🎀

👑 HISTORY 👑

X509_REQ_get0_X509_PUBKEY() was constified in OpenSSL 4.0. ✨

X509_get_pubkey() and X509_REQ_get_pubkey() are deprecated but retained for backward compatibility. (they're the retired icons still showing up to the function, we respect them but we don't invite them to new projects 💀)

X509_get_pubkey() was converted to use a const parameter in OpenSSL 4.0.

Copyright 2015-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

ok that's the whole page bestie, literally every option, every return value, every ownership rule 💅 go forth and free your EVP_PKEYs (only the ones you're supposed to!!) 🫶

X509_GET_PUBKEY(3SSL) — OpenSSL 4.0.3 — 2026-09-29 🌈⭐💖

📦 where this page comes from