---
name: "libressl-X509_CRL_new"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_CRL_new"
---

# libressl-X509\_CRL\_new(3)

X.509 certificate revocation lists

## NAME

**X509\_CRL\_new**, **X509\_CRL\_dup**, **X509\_CRL\_up\_ref**, **X509\_CRL\_free**, **X509\_CRL\_INFO\_new**, **X509\_CRL\_INFO\_free** – X.509 certificate revocation lists

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*X509\_CRL* *\**\

**X509\_CRL\_new**(*void*);

*X509\_CRL* *\**\

**X509\_CRL\_dup**(*X509\_CRL \*crl*);

*int*\

**X509\_CRL\_up\_ref**(*X509\_CRL \*crl*);

*void*\

**X509\_CRL\_free**(*X509\_CRL \*crl*);

*X509\_CRL\_INFO* *\**\

**X509\_CRL\_INFO\_new**(*void*);

*void*\

**X509\_CRL\_INFO\_free**(*X509\_CRL\_INFO \*crl\_info*);

## DESCRIPTION

**X509\_CRL\_new**() allocates and initializes an empty *X509\_CRL* object, representing an ASN.1 *CertificateList* structure defined in RFC 5280 section 5.1. It can hold a pointer to an *X509\_CRL\_INFO* object discussed below together with a cryptographic signature and information about the signature algorithm used. The reference count is set to 1.

**X509\_CRL\_dup**() creates a deep copy of *crl*.

**X509\_CRL\_up\_ref**() increments the reference count of *crl* by 1.

**X509\_CRL\_free**() decrements the reference count of *crl* by 1. If the reference count reaches 0, it frees *crl*.

**X509\_CRL\_INFO\_new**() allocates and initializes an empty *X509\_CRL\_INFO* object, representing an ASN.1 *TBSCertList* structure defined in RFC 5280 section 5.1. It is used inside the *X509\_CRL* object and can hold a list of revoked certificates, an issuer name, the time the list was issued, the time when the next update of the list is due, and optional extensions. **X509\_CRL\_INFO\_free**() frees *crl\_info*.

## RETURN VALUES

**X509\_CRL\_new**(), **X509\_CRL\_dup**(), and **X509\_CRL\_INFO\_new**() return the new *X509\_CRL* or *X509\_CRL\_INFO* object, respectively, or NULL if an error occurs.

**X509\_CRL\_up\_ref**() returns 1 on success or 0 on error.

## SEE ALSO

ACCESS\_DESCRIPTION\_new(3), AUTHORITY\_KEYID\_new(3), d2i\_X509\_CRL(3), DIST\_POINT\_new(3), PEM\_read\_X509\_CRL(3), X509\_CRL\_digest(3), X509\_CRL\_get0\_by\_serial(3), X509\_CRL\_get0\_lastUpdate(3), X509\_CRL\_get0\_signature(3), X509\_CRL\_get\_ext(3), X509\_CRL\_get\_ext\_d2i(3), X509\_CRL\_get\_issuer(3), X509\_CRL\_get\_version(3), X509\_CRL\_match(3), X509\_CRL\_print(3), X509\_CRL\_sign(3), X509\_EXTENSION\_new(3), X509\_INFO\_new(3), X509\_load\_crl\_file(3), X509\_new(3), X509\_OBJECT\_get0\_X509\_CRL(3), X509\_REVOKED\_new(3), X509\_STORE\_CTX\_set0\_crls(3), X509\_STORE\_get1\_crls(3)

## STANDARDS

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, section 5: CRL and CRL Extensions Profile

## HISTORY

**X509\_CRL\_new**(), **X509\_CRL\_free**(), **X509\_CRL\_INFO\_new**(), and **X509\_CRL\_INFO\_free**() first appeared in SSLeay 0.4.4. **X509\_CRL\_dup**() first appeared in SSLeay 0.5.1. These functions have been available since OpenBSD 2.4.

**X509\_CRL\_up\_ref**() first appeared in OpenSSL 1.1.0 and has been available since OpenBSD 6.3.