--- name: "libressl-X509V3_get_d2i" section: "3" platform: "linux" package: "libressl" version: "4.4.0-1" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/libressl-X509V3_get_d2i" --- # libressl-X509V3\_get\_d2i(3) X509 extension decode and encode functions ## NAME **X509V3\_get\_d2i**, **X509V3\_add1\_i2d**, **X509V3\_EXT\_d2i**, **X509V3\_EXT\_i2d**, **X509\_get\_ext\_d2i**, **X509\_add1\_ext\_i2d**, **X509\_CRL\_get\_ext\_d2i**, **X509\_CRL\_add1\_ext\_i2d**, **X509\_REVOKED\_get\_ext\_d2i**, **X509\_REVOKED\_add1\_ext\_i2d**, **X509\_get0\_extensions**, **X509\_CRL\_get0\_extensions**, **X509\_REVOKED\_get0\_extensions**, **X509\_get0\_uids** – X509 extension decode and encode functions ## SYNOPSIS Crypto Library (libcrypto, -lcrypto) **#include \** *void* *\**\ **X509V3\_get\_d2i**(*const STACK\_OF(X509\_EXTENSION) \*x*, *int nid*, *int \*crit*, *int \*idx*); *int*\ **X509V3\_add1\_i2d**(*STACK\_OF(X509\_EXTENSION) \*\*x*, *int nid*, *void \*value*, *int crit*, *unsigned long flags*); *void* *\**\ **X509V3\_EXT\_d2i**(*X509\_EXTENSION \*ext*); *X509\_EXTENSION* *\**\ **X509V3\_EXT\_i2d**(*int ext\_nid*, *int crit*, *void \*ext*); *void* *\**\ **X509\_get\_ext\_d2i**(*const X509 \*x*, *int nid*, *int \*crit*, *int \*idx*); *int*\ **X509\_add1\_ext\_i2d**(*X509 \*x*, *int nid*, *void \*value*, *int crit*, *unsigned long flags*); *void* *\**\ **X509\_CRL\_get\_ext\_d2i**(*const X509\_CRL \*crl*, *int nid*, *int \*crit*, *int \*idx*); *int*\ **X509\_CRL\_add1\_ext\_i2d**(*X509\_CRL \*crl*, *int nid*, *void \*value*, *int crit*, *unsigned long flags*); *void* *\**\ **X509\_REVOKED\_get\_ext\_d2i**(*const X509\_REVOKED \*r*, *int nid*, *int \*crit*, *int \*idx*); *int*\ **X509\_REVOKED\_add1\_ext\_i2d**(*X509\_REVOKED \*r*, *int nid*, *void \*value*, *int crit*, *unsigned long flags*); *const* *STACK\_OF(X509\_EXTENSION)* *\**\ **X509\_get0\_extensions**(*const X509 \*x*); *const* *STACK\_OF(X509\_EXTENSION)* *\**\ **X509\_CRL\_get0\_extensions**(*const X509\_CRL \*crl*); *const* *STACK\_OF(X509\_EXTENSION)* *\**\ **X509\_REVOKED\_get0\_extensions**(*const X509\_REVOKED \*r*); *void*\ **X509\_get0\_uids**(*const X509 \*x*, *const ASN1\_BIT\_STRING \*\*issuerUID*, *const ASN1\_BIT\_STRING \*\*subjectUID*); ## DESCRIPTION **X509V3\_get\_d2i**() looks for an extension with OID *nid* in the extensions *x* and, if found, decodes it. If *idx* is NULL, then only one occurrence of an extension is permissible. Otherwise the first extension after index \**idx* is returned and \**idx* is updated to the location of the extension. If *crit* is not NULL, then \**crit* is set to a status value: -2 if the extension occurs multiple times (this is only returned if *idx* is NULL), -1 if the extension could not be found, 0 if the extension is found and is not critical, and 1 if it is critical. A pointer to an extension specific structure or NULL is returned. **X509V3\_add1\_i2d**() adds extension *value* to STACK \**x* (allocating a new STACK if necessary) using OID *nid* and criticality *crit* according to *flags*. **X509V3\_EXT\_d2i**() attempts to decode the ASN.1 data contained in extension *ext* and returns a pointer to an extension specific structure or NULL if the extension could not be decoded (invalid syntax or not supported). **X509V3\_EXT\_i2d**() encodes the extension specific structure *ext* with OID *ext\_nid* and criticality *crit*. **X509\_get\_ext\_d2i**() and **X509\_add1\_ext\_i2d**() operate on the extensions of certificate *x*, and are otherwise identical to **X509V3\_get\_d2i**() and **X509V3\_add1\_i2d**(). **X509\_CRL\_get\_ext\_d2i**() and **X509\_CRL\_add1\_ext\_i2d**() operate on the extensions of CRL *crl*, and are otherwise identical to **X509V3\_get\_d2i**() and **X509V3\_add1\_i2d**(). **X509\_REVOKED\_get\_ext\_d2i**() and **X509\_REVOKED\_add1\_ext\_i2d**() operate on the extensions of the *X509\_REVOKED* structure *r* (i.e. for CRL entry extensions), and are otherwise identical to **X509V3\_get\_d2i**() and **X509V3\_add1\_i2d**(). **X509\_get0\_extensions**(), **X509\_CRL\_get0\_extensions**(), and **X509\_REVOKED\_get0\_extensions**() return a stack of all the extensions of a certificate, a CRL, or a CRL entry, respectively. In almost all cases an extension can occur at most once and multiple occurrences is an error. Therefore the *idx* parameter is usually NULL. The *flags* argument consists of two parts OR'ed together: the operation mode and the optional silent flag. The operation mode is the bitwise OR of the *flags* and the bitmask X509V3\_ADD\_OP\_MASK. The following operation modes are recognized: X509V3\_ADD\_DEFAULT appends a new extension only if the extension does not already exist. An error is returned if the extension does already exist. X509V3\_ADD\_APPEND appends a new extension, ignoring whether the extension already exists. This is a misfeature and should not be used because certificates must not include the same extension more than once. X509V3\_ADD\_REPLACE replaces an extension if it exists otherwise appends a new extension. X509V3\_ADD\_REPLACE\_EXISTING replaces an existing extension if it exists otherwise returns an error. X509V3\_ADD\_KEEP\_EXISTING appends a new extension only if the extension does not already exist. An error **is** **not** returned if the extension does already exist. X509V3\_ADD\_DELETE deletes extension *nid* if it exists and errors otherwise. No new extension is added. Any other operation mode results in an error. If X509V3\_ADD\_SILENT is OR'd into the *flags*, any error returned will not be added to the error queue. The function **X509V3\_get\_d2i**() will return NULL if the extension is not found, occurs multiple times or cannot be decoded. It is possible to determine the precise reason by checking the value of \**crit*. **X509\_get0\_uids**() returns the issuer and subject unique identifiers of the certificate *x* in \**issuerUID* and \**subjectUID*. If a unique identifier field is not present in *x*, NULL is returned. Either one of *issuerUID* and *subjectUID* can be NULL. ## SUPPORTED EXTENSIONS The following sections contain a list of all supported extensions including their name and NID. ### PKIX Certificate Extensions The following certificate extensions are defined in PKIX standards such as RFC 5280. | | | | --- | --- | | Basic Constraints | NID\_basic\_constraints | | Key Usage | NID\_key\_usage | | Extended Key Usage | NID\_ext\_key\_usage | | Subject Key Identifier | NID\_subject\_key\_identifier | | Authority Key Identifier | NID\_authority\_key\_identifier | | Private Key Usage Period | NID\_private\_key\_usage\_period | | Subject Alternative Name | NID\_subject\_alt\_name | | Issuer Alternative Name | NID\_issuer\_alt\_name | | Authority Information Access | NID\_info\_access | | Subject Information Access | NID\_sinfo\_access | | Name Constraints | NID\_name\_constraints | | Certificate Policies | NID\_certificate\_policies | | Policy Mappings | NID\_policy\_mappings | | Policy Constraints | NID\_policy\_constraints | | Inhibit Any Policy | NID\_inhibit\_any\_policy | | IP Address Delegation | NID\_sbgp\_ipAddrBlock | | Autonomous System Identifier Delegation | NID\_sbgp\_autonomousSysNum | ### Netscape Certificate Extensions The following are (largely obsolete) Netscape certificate extensions. | | | | --- | --- | | Netscape Cert Type | NID\_netscape\_cert\_type | | Netscape Base Url | NID\_netscape\_base\_url | | Netscape Revocation Url | NID\_netscape\_revocation\_url | | Netscape CA Revocation Url | NID\_netscape\_ca\_revocation\_url | | Netscape Renewal Url | NID\_netscape\_renewal\_url | | Netscape CA Policy Url | NID\_netscape\_ca\_policy\_url | | Netscape SSL Server Name | NID\_netscape\_ssl\_server\_name | | Netscape Comment | NID\_netscape\_comment | ### PKIX CRL Extensions The following are CRL extensions from PKIX standards such as RFC 5280. | | | | --- | --- | | CRL Number | NID\_crl\_number | | CRL Distribution Points | NID\_crl\_distribution\_points | | Delta CRL Indicator | NID\_delta\_crl | | Freshest CRL | NID\_freshest\_crl | | Invalidity Date | NID\_invalidity\_date | | Issuing Distribution Point | NID\_issuing\_distribution\_point | The following are CRL entry extensions from PKIX standards such as RFC 5280. | | | | --- | --- | | CRL Reason Code | NID\_crl\_reason | | Certificate Issuer | NID\_certificate\_issuer | ### OCSP Extensions | | | | --- | --- | | OCSP Nonce | NID\_id\_pkix\_OCSP\_Nonce | | OCSP CRL ID | NID\_id\_pkix\_OCSP\_CrlID | | Acceptable OCSP Responses | NID\_id\_pkix\_OCSP\_acceptableResponses | | OCSP Check | NID\_id\_pkix\_OCSP\_noCheck | | OCSP Archive Cutoff | NID\_id\_pkix\_OCSP\_archiveCutoff | | OCSP Service Locator | NID\_id\_pkix\_OCSP\_serviceLocator | | Hold Instruction Code | NID\_hold\_instruction\_code | ## RETURN VALUES **X509V3\_get\_d2i**(), **X509V3\_EXT\_d2i**(), **X509\_get\_ext\_d2i**(), **X509\_CRL\_get\_ext\_d2i**(), and **X509\_REVOKED\_get\_ext\_d2i**() return a pointer to an extension specific structure or NULL if an error occurs. **X509V3\_add1\_i2d**(), **X509\_add1\_ext\_i2d**(), **X509\_CRL\_add1\_ext\_i2d**(), and **X509\_REVOKED\_add1\_ext\_i2d**() return 1 if the operation is successful, 0 if it fails due to a non-fatal error (extension not found, already exists, cannot be encoded), or -1 due to a fatal error such as a memory allocation failure. In some cases of failure, the reason can be determined with ERR\_get\_error(3). The **X509V3\_EXT\_i2d**() function returns a pointer to an *X509\_EXTENSION* structure if successful; otherwise NULL is returned and an error code can be retrieved with ERR\_get\_error(3). **X509\_get0\_extensions**(), **X509\_CRL\_get0\_extensions**(), and **X509\_REVOKED\_get0\_extensions**() return a stack of extensions, or NULL if no extensions are present. ## SEE ALSO d2i\_X509(3), d2i\_X509\_EXTENSION(3), X509\_check\_purpose(3), X509\_CRL\_get0\_by\_serial(3), X509\_CRL\_new(3), X509\_EXTENSION\_new(3), X509\_get\_pubkey(3), X509\_get\_subject\_name(3), X509\_get\_version(3), X509\_new(3), X509\_REVOKED\_new(3), X509V3\_EXT\_print(3), X509V3\_extensions\_print(3) ## HISTORY **X509V3\_EXT\_d2i**() first appeared in OpenSSL 0.9.2b. **X509V3\_EXT\_i2d**() first appeared in OpenSSL 0.9.3. Both functions have been available since OpenBSD 2.6. **X509V3\_get\_d2i**(), **X509\_get\_ext\_d2i**(), **X509\_CRL\_get\_ext\_d2i**(), and **X509\_REVOKED\_get\_ext\_d2i**() first appeared in OpenSSL 0.9.5 and have been available since OpenBSD 2.7. **X509V3\_add1\_i2d**(), **X509\_add1\_ext\_i2d**(), **X509\_CRL\_add1\_ext\_i2d**(), and **X509\_REVOKED\_add1\_ext\_i2d**() first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2. **X509\_get0\_extensions**(), **X509\_CRL\_get0\_extensions**(), and **X509\_REVOKED\_get0\_extensions**() first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 6.3. **X509\_get0\_uids**() first appeared in OpenSSL 1.1.0 and has been available since OpenBSD 7.3.