---
name: "libressl-EXTENDED_KEY_USAGE_new"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-EXTENDED_KEY_USAGE_new"
---

# libressl-EXTENDED\_KEY\_USAGE\_new(3)

X.509 key usage restrictions

## NAME

**EXTENDED\_KEY\_USAGE\_new**, **EXTENDED\_KEY\_USAGE\_free** – X.509 key usage restrictions

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509v3.h\>**

*EXTENDED\_KEY\_USAGE*\

**EXTENDED\_KEY\_USAGE\_new**(*void*);

*void*\

**EXTENDED\_KEY\_USAGE\_free**(*EXTENDED\_KEY\_USAGE \*eku*);

## DESCRIPTION

By using the key usage extension, the extended key usage extension, or both of them, *X509* end entity certificates may indicate that the key contained in them is only intended to be used for the specified purposes. If both extensions are present, only uses compatible with both extensions are intended.

**EXTENDED\_KEY\_USAGE\_new**() allocates and initializes an empty *EXTENDED\_KEY\_USAGE* object, which is a *STACK\_OF(ASN1\_OBJECT)* and represents an ASN.1 *ExtKeyUsageSyntax* structure defined in RFC 5280 section 4.2.1.12. It can hold key purpose identifiers.

**EXTENDED\_KEY\_USAGE\_free**() frees *eku*.

The key usage extension uses the ASN.1 BIT STRING data type and doesn't require any dedicated object.

## RETURN VALUES

**EXTENDED\_KEY\_USAGE\_new**() returns the new *EXTENDED\_KEY\_USAGE* object or NULL if an error occurs.

## SEE ALSO

BASIC\_CONSTRAINTS\_new(3), d2i\_EXTENDED\_KEY\_USAGE(3), POLICYINFO\_new(3), X509\_check\_purpose(3), X509\_EXTENSION\_new(3), X509\_get\_extension\_flags(3), X509\_new(3)

## STANDARDS

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile:

- section 4.2.1.3: Key Usage

- section 4.2.1.12: Extended Key Usage

## HISTORY

**EXTENDED\_KEY\_USAGE\_new**() and **EXTENDED\_KEY\_USAGE\_free**() first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2.