---
name: "libressl-X509_CRL_get0_by_serial"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_CRL_get0_by_serial"
---

# libressl-X509\_CRL\_get0\_by\_serial(3)

add, sort, and retrieve CRL entries

## NAME

**X509\_CRL\_get0\_by\_serial**, **X509\_CRL\_get0\_by\_cert**, **X509\_CRL\_get\_REVOKED**, **X509\_CRL\_add0\_revoked**, **X509\_CRL\_sort** – add, sort, and retrieve CRL entries

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*int*\

**X509\_CRL\_get0\_by\_serial**(*X509\_CRL \*crl*, *X509\_REVOKED \*\*ret*, *ASN1\_INTEGER \*serial*);

*int*\

**X509\_CRL\_get0\_by\_cert**(*X509\_CRL \*crl*, *X509\_REVOKED \*\*ret*, *X509 \*x*);

*STACK\_OF(X509\_REVOKED)* *\**\

**X509\_CRL\_get\_REVOKED**(*X509\_CRL \*crl*);

*int*\

**X509\_CRL\_add0\_revoked**(*X509\_CRL \*crl*, *X509\_REVOKED \*rev*);

*int*\

**X509\_CRL\_sort**(*X509\_CRL \*crl*);

## DESCRIPTION

**X509\_CRL\_get0\_by\_serial**() attempts to find a revoked entry in *crl* for serial number *serial*. If it is successful, it sets \**ret* to the internal pointer of the matching entry. Consequently, \**ret* must not be freed up after the call.

**X509\_CRL\_get0\_by\_cert**() is similar to **X509\_CRL\_get0\_by\_serial**() except that it looks for a revoked entry using the serial number of certificate *x*.

**X509\_CRL\_get\_REVOKED**() returns an internal pointer to a stack of all revoked entries for *crl*.

**X509\_CRL\_add0\_revoked**() appends revoked entry *rev* to CRL *crl*. The pointer *rev* is used internally so it must not be freed up after the call: it is freed when the parent CRL is freed.

**X509\_CRL\_sort**() sorts the revoked entries of *crl* into ascending serial number order.

Applications can determine the number of revoked entries returned by **X509\_CRL\_get\_revoked**() using **sk\_X509\_REVOKED\_num**() and examine each one in turn using **sk\_X509\_REVOKED\_value**(), both defined in ⟨openssl/safestack.h⟩.

## RETURN VALUES

**X509\_CRL\_get0\_by\_serial**() and **X509\_CRL\_get0\_by\_cert**() return 0 for failure or 1 for success, except if the revoked entry has the reason "removeFromCRL", in which case 2 is returned.

The **X509\_CRL\_add0\_revoked**() function returns 1 if successful; otherwise 0 is returned and an error code can be retrieved with ERR\_get\_error(3).

**X509\_CRL\_sort**() returns 1 for success or 0 for failure. The current implementation cannot fail.

**X509\_CRL\_get\_REVOKED**() returns a STACK of revoked entries.

## SEE ALSO

d2i\_X509\_CRL(3), X509\_CRL\_get\_ext(3), X509\_CRL\_get\_issuer(3), X509\_CRL\_get\_version(3), X509\_CRL\_new(3), X509\_REVOKED\_new(3), X509V3\_get\_d2i(3)

## HISTORY

**X509\_CRL\_get\_REVOKED**() first appeared in OpenSSL 0.9.2b and has been available since OpenBSD 2.6.

**X509\_CRL\_add0\_revoked**() and **X509\_CRL\_sort**() first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2.

**X509\_CRL\_get0\_by\_serial**() and **X509\_CRL\_get0\_by\_cert**() first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9.