---
name: "libressl-SSL_CTX_add1_chain_cert"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-SSL_CTX_add1_chain_cert"
---

# libressl-SSL\_CTX\_add1\_chain\_cert(3)

extra chain certificate processing

## NAME

**SSL\_CTX\_set0\_chain**, **SSL\_CTX\_set1\_chain**, **SSL\_CTX\_add0\_chain\_cert**, **SSL\_CTX\_add1\_chain\_cert**, **SSL\_CTX\_get0\_chain\_certs**, **SSL\_CTX\_clear\_chain\_certs**, **SSL\_set0\_chain**, **SSL\_set1\_chain**, **SSL\_add0\_chain\_cert**, **SSL\_add1\_chain\_cert**, **SSL\_get0\_chain\_certs**, **SSL\_clear\_chain\_certs** – extra chain certificate processing

## SYNOPSIS

SSL Library (libssl, -lssl) libcrypto

**#include \<openssl/ssl.h\>**

*int*\

**SSL\_CTX\_set0\_chain**(*SSL\_CTX \*ctx*, *STACK\_OF(X509) \*chain*);

*int*\

**SSL\_CTX\_set1\_chain**(*SSL\_CTX \*ctx*, *STACK\_OF(X509) \*chain*);

*int*\

**SSL\_CTX\_add0\_chain\_cert**(*SSL\_CTX \*ctx*, *X509 \*cert*);

*int*\

**SSL\_CTX\_add1\_chain\_cert**(*SSL\_CTX \*ctx*, *X509 \*cert*);

*int*\

**SSL\_CTX\_get0\_chain\_certs**(*SSL\_CTX \*ctx*, *STACK\_OF(X509) \*\*chain*);

*int*\

**SSL\_CTX\_clear\_chain\_certs**(*SSL\_CTX \*ctx*);

*int*\

**SSL\_set0\_chain**(*SSL \*ssl*, *STACK\_OF(X509) \*chain*);

*int*\

**SSL\_set1\_chain**(*SSL \*ssl*, *STACK\_OF(X509) \*chain*);

*int*\

**SSL\_add0\_chain\_cert**(*SSL \*ssl*, *X509 \*cert*);

*int*\

**SSL\_add1\_chain\_cert**(*SSL \*ssl*, *X509 \*cert*);

*int*\

**SSL\_get0\_chain\_certs**(*SSL \*ssl*, *STACK\_OF(X509) \*\*chain*);

*int*\

**SSL\_clear\_chain\_certs**(*SSL \*ssl*);

## DESCRIPTION

**SSL\_CTX\_set0\_chain**() and **SSL\_CTX\_set1\_chain**() set the certificate chain associated with the current certificate of *ctx* to *chain*. The *chain* is not supposed to include the current certificate itself.

**SSL\_CTX\_add0\_chain\_cert**() and **SSL\_CTX\_add1\_chain\_cert**() append the single certificate *cert* to the chain associated with the current certificate of *ctx*.

**SSL\_CTX\_get0\_chain\_certs**() retrieves the chain associated with the current certificate of *ctx*.

**SSL\_CTX\_clear\_chain\_certs**() clears the existing chain associated with the current certificate of *ctx*, if any. This is equivalent to calling **SSL\_CTX\_set0\_chain**() with *chain* set to NULL.

Each of these functions operates on the *current* end entity (i.e. server or client) certificate. This is the last certificate loaded or selected on the corresponding *ctx* structure, for example using SSL\_CTX\_use\_certificate(3).

**SSL\_set0\_chain**(), **SSL\_set1\_chain**(), **SSL\_add0\_chain\_cert**(), **SSL\_add1\_chain\_cert**(), **SSL\_get0\_chain\_certs**(), and **SSL\_clear\_chain\_certs**() are similar except that they operate on the *ssl* connection.

The functions containing a **1** in their name increment the reference count of the supplied certificate or chain, so it must be freed at some point after the operation. Those containing a **0** do not increment reference counts and the supplied certificate or chain must not be freed after the operation.

The chains associated with an *SSL\_CTX* structure are copied to the new *SSL* structure when SSL\_new(3) is called. Existing *SSL* structures are not affected by any chains subsequently changed in the parent *SSL\_CTX*.

One chain can be set for each key type supported by a server. So, for example, an RSA and an ECDSA certificate can have different chains.

If any certificates are added using these functions, no certificates added using SSL\_CTX\_add\_extra\_chain\_cert(3) will be used.

## RETURN VALUES

These functions return 1 for success or 0 for failure.

## SEE ALSO

[ssl(3)](/ssl/3.md), SSL\_CTX\_add\_extra\_chain\_cert(3), SSL\_CTX\_use\_certificate(3)

## HISTORY

These functions first appeared in OpenSSL 1.0.2 and have been available since OpenBSD 6.5.