---
name: "libressl-X509_ATTRIBUTE_new"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_ATTRIBUTE_new"
---

# libressl-X509\_ATTRIBUTE\_new(3)

generic X.501 Attribute

## NAME

**X509\_ATTRIBUTE\_new**, **X509\_ATTRIBUTE\_create**, **X509\_ATTRIBUTE\_dup**, **X509\_ATTRIBUTE\_free** – generic X.501 Attribute

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*X509\_ATTRIBUTE* *\**\

**X509\_ATTRIBUTE\_new**(*void*);

*X509\_ATTRIBUTE* *\**\

**X509\_ATTRIBUTE\_create**(*int nid*, *int type*, *void \*value*);

*X509\_ATTRIBUTE* *\**\

**X509\_ATTRIBUTE\_dup**(*X509\_ATTRIBUTE \*attr*);

*void*\

**X509\_ATTRIBUTE\_free**(*X509\_ATTRIBUTE \*attr*);

## DESCRIPTION

In the X.501 standard, an *Attribute* is the fundamental ASN.1 data type used to represent any kind of property of any kind of directory entry. In OpenSSL, very few objects use it directly, most notably the *X509\_REQ\_INFO* object used for PKCS#10 certification requests described in X509\_REQ\_new(3), the *PKCS8\_PRIV\_KEY\_INFO* object used for PKCS#8 private key information described in PKCS8\_PRIV\_KEY\_INFO\_new(3), and the *PKCS12\_SAFEBAG* container object described in PKCS12\_SAFEBAG\_new(3).

**X509\_ATTRIBUTE\_new**() allocates and initializes an empty *X509\_ATTRIBUTE* object.

**X509\_ATTRIBUTE\_create**() allocates a new multi-valued *X509\_ATTRIBUTE* object of the type *nid* and initializes its set of values to contain one new ASN.1 ANY object with the given *value* and *type*. The *type* usually is one of the V\_ASN1\_\* constants defined in ⟨openssl/asn1.h⟩; it is stored without validating it. If the function succeeds, ownership of the *value* is transferred to the new *X509\_ATTRIBUTE* object.

Be careful to not confuse the type of the attribute and the type of the value.

**X509\_ATTRIBUTE\_dup**() creates a deep copy of *attr*.

**X509\_ATTRIBUTE\_free**() frees *attr*.

## RETURN VALUES

**X509\_ATTRIBUTE\_new**(), **X509\_ATTRIBUTE\_create**(), and **X509\_ATTRIBUTE\_dup**() return the new *X509\_ATTRIBUTE* object or NULL if an error occurs.

In particular, these functions fail if memory allocation fails. **X509\_ATTRIBUTE\_create**() also fails if OBJ\_nid2obj(3) fails on *nid*.

## SEE ALSO

d2i\_X509\_ATTRIBUTE(3), OBJ\_nid2obj(3), PKCS12\_SAFEBAG\_new(3), PKCS7\_add\_attribute(3), PKCS8\_pkey\_get0\_attrs(3), PKCS8\_PRIV\_KEY\_INFO\_new(3), X509\_ATTRIBUTE\_get0\_object(3), X509\_ATTRIBUTE\_set1\_object(3), X509\_EXTENSION\_new(3), X509\_new(3), X509\_REQ\_add1\_attr(3), X509\_REQ\_new(3)

## STANDARDS

-

  For the general definition of the *Attribute* data type: ITU-T Recommendation X.501, also known as ISO/IEC 9594-2: Information Technology – Open Systems Interconnection – The Directory: Models, section 8.2: Overall structure

- For the specific definition in the context of certification requests:

  RFC 2986: PKCS #10: Certification Request Syntax Specification, section 4.1: CertificationRequestInfo

- For the specific use in the context of private key information:

  RFC 5208: Public-Key Cryptography Standards (PKCS) #8: Private-Key Information Syntax Specification

- For the specific definition in the context of PFX:

  RFC 7292: PKCS #12: Personal Information Exchange Syntax, section 4.2: The SafeBag Type

## HISTORY

**X509\_ATTRIBUTE\_new**() and **X509\_ATTRIBUTE\_free**() first appeared in SSLeay 0.5.1 and have been available since OpenBSD 2.4.

**X509\_ATTRIBUTE\_create**() and **X509\_ATTRIBUTE\_dup**() first appeared in SSLeay 0.9.1 and have been available since OpenBSD 2.6.

## BUGS

A data type designed to hold arbitrary data is an oxymoron.

While it may occasionally be useful for abstract syntax specification or for generic container objects, using it for the representation of specific data in a specific data structure feels like dubious design.

Having two distinct data types to hold arbitrary data – in this case, *X509\_ATTRIBUTE* on the X.501 language level and *X509\_EXTENSION* as described in X509\_EXTENSION\_new(3) on the X.509 language level – feels even more questionable, in particular considering that Attributes in certification requests can be used to ask for Extensions in certificates.

At the very least, the direct use of the low-level generic *X509\_ATTRIBUTE* type in specific data types like certification requests or private key information looks like a layering violation and appears to put type safety into jeopardy.