---
name: "libressl-SSL_get_peer_certificate"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-SSL_get_peer_certificate"
---

# libressl-SSL\_get\_peer\_certificate(3)

get the X509 certificate of the peer

## NAME

**SSL\_get\_peer\_certificate** – get the X509 certificate of the peer

## SYNOPSIS

SSL Library (libssl, -lssl) libcrypto

**#include \<openssl/ssl.h\>**

*X509* *\**\

**SSL\_get\_peer\_certificate**(*const SSL \*ssl*);

## DESCRIPTION

**SSL\_get\_peer\_certificate**() returns a pointer to the X509 certificate the peer presented. If the peer did not present a certificate, NULL is returned.

Due to the protocol definition, a TLS/SSL server will always send a certificate, if present. A client will only send a certificate when explicitly requested to do so by the server (see SSL\_CTX\_set\_verify(3)). If an anonymous cipher is used, no certificates are sent.

That a certificate is returned does not indicate information about the verification state. Use SSL\_get\_verify\_result(3) to check the verification state.

The reference count of the *X509* object is incremented by one, so that it will not be destroyed when the session containing the peer certificate is freed. The *X509* object must be explicitly freed using X509\_free(3).

## RETURN VALUES

The following return values can occur:

- NULL

  No certificate was presented by the peer or no connection was established.

- Pointer to an X509 certificate

  The return value points to the certificate presented by the peer.

## SEE ALSO

[ssl(3)](/ssl/3.md), SSL\_CTX\_set\_verify(3), SSL\_get0\_peername(3), SSL\_get\_verify\_result(3)

## HISTORY

**SSL\_get\_peer\_certificate**() appeared in SSLeay 0.4 or earlier and has been available since OpenBSD 2.4.