---
name: "libressl-X509_EXTENSION_set_object"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_EXTENSION_set_object"
---

# libressl-X509\_EXTENSION\_set\_object(3)

create, change, and inspect X.509 Extension objects

## NAME

**X509\_EXTENSION\_new**, **X509\_EXTENSION\_dup**, **X509\_EXTENSION\_free**, **X509\_EXTENSION\_create\_by\_NID**, **X509\_EXTENSION\_create\_by\_OBJ**, **X509\_EXTENSION\_set\_object**, **X509\_EXTENSION\_set\_critical**, **X509\_EXTENSION\_set\_data**, **X509\_EXTENSION\_get\_object**, **X509\_EXTENSION\_get\_critical**, **X509\_EXTENSION\_get\_data**, **X509\_supported\_extension** – create, change, and inspect X.509 Extension objects

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*X509\_EXTENSION* *\**\

**X509\_EXTENSION\_new**(*void*);

*X509\_EXTENSION* *\**\

**X509\_EXTENSION\_dup**(*X509\_EXTENSION \*ex*);

*void*\

**X509\_EXTENSION\_free**(*X509\_EXTENSION \*ex*);

*X509\_EXTENSION* *\**\

**X509\_EXTENSION\_create\_by\_NID**(*X509\_EXTENSION \*\*ex*, *int nid*, *int crit*, *ASN1\_OCTET\_STRING \*data*);

*X509\_EXTENSION* *\**\

**X509\_EXTENSION\_create\_by\_OBJ**(*X509\_EXTENSION \*\*ex*, *const ASN1\_OBJECT \*obj*, *int crit*, *ASN1\_OCTET\_STRING \*data*);

*int*\

**X509\_EXTENSION\_set\_object**(*X509\_EXTENSION \*ex*, *const ASN1\_OBJECT \*obj*);

*int*\

**X509\_EXTENSION\_set\_critical**(*X509\_EXTENSION \*ex*, *int crit*);

*int*\

**X509\_EXTENSION\_set\_data**(*X509\_EXTENSION \*ex*, *ASN1\_OCTET\_STRING \*data*);

*ASN1\_OBJECT* *\**\

**X509\_EXTENSION\_get\_object**(*X509\_EXTENSION \*ex*);

*int*\

**X509\_EXTENSION\_get\_critical**(*const X509\_EXTENSION \*ex*);

*ASN1\_OCTET\_STRING* *\**\

**X509\_EXTENSION\_get\_data**(*X509\_EXTENSION \*ex*);

*int*\

**X509\_supported\_extension**(*X509\_EXTENSION \*ex*);

## DESCRIPTION

**X509\_EXTENSION\_new**() allocates and initializes an empty *X509\_EXTENSION* object, representing an ASN.1 *Extension* structure defined in RFC 5280 section 4.1. It is a wrapper object around specific extension objects of different types and stores an extension type identifier and a criticality flag in addition to the DER-encoded form of the wrapped object. *X509\_EXTENSION* objects can be used for X.509 v3 certificates inside *X509\_CINF* objects and for X.509 v2 certificate revocation lists inside *X509\_CRL\_INFO* and *X509\_REVOKED* objects.

**X509\_EXTENSION\_dup**() creates a deep copy of *ex* using ASN1\_item\_dup(3).

**X509\_EXTENSION\_free**() frees *ex* and all objects it is using.

**X509\_EXTENSION\_create\_by\_NID**() creates an extension of type *nid* and criticality *crit* using data *data*. The created extension is returned and written to \**ex* reusing or allocating a new extension if necessary, so \**ex* should either be NULL or a valid *X509\_EXTENSION* structure. It must not be an uninitialised pointer.

**X509\_EXTENSION\_create\_by\_OBJ**() is identical to **X509\_EXTENSION\_create\_by\_NID**() except that it creates an extension using *obj* instead of a NID.

**X509\_EXTENSION\_set\_object**() sets the extension type of *ex* to *obj*. The *obj* pointer is duplicated internally so *obj* should be freed up after use.

**X509\_EXTENSION\_set\_critical**() sets the criticality of *ex* to *crit*. If *crit* is zero, the extension in non-critical, otherwise it is critical.

**X509\_EXTENSION\_set\_data**() sets the data in extension *ex* to *data*. The *data* pointer is duplicated internally.

**X509\_EXTENSION\_get\_object**() returns the extension type of *ex* as an *ASN1\_OBJECT* pointer. The returned pointer is an internal value which must not be freed up.

**X509\_EXTENSION\_get\_critical**() tests whether *ex* is critical.

**X509\_EXTENSION\_get\_data**() returns the data of extension *ex*. The returned pointer is an internal value which must not be freed up.

**X509\_supported\_extension**() checks whether *ex* is of a type supported by the verifier. The list of supported extension types is hardcoded into the library. If an extension is critical but unsupported, the certificate will normally be rejected.

These functions manipulate the contents of an extension directly. Most applications will want to parse or encode and add an extension: they should use the extension encode and decode functions instead such as X509\_add1\_ext\_i2d(3) and X509\_get\_ext\_d2i(3).

The *data* associated with an extension is the extension encoding in an *ASN1\_OCTET\_STRING* structure.

## RETURN VALUES

**X509\_EXTENSION\_new**(), **X509\_EXTENSION\_dup**(), **X509\_EXTENSION\_create\_by\_NID**(), and **X509\_EXTENSION\_create\_by\_OBJ**() return an *X509\_EXTENSION* pointer or NULL if an error occurs.

**X509\_EXTENSION\_set\_object**(), **X509\_EXTENSION\_set\_critical**(), and **X509\_EXTENSION\_set\_data**() return 1 for success or 0 for failure.

**X509\_EXTENSION\_get\_object**() returns an *ASN1\_OBJECT* pointer.

**X509\_EXTENSION\_get\_critical**() returns 0 for non-critical or 1 for critical.

**X509\_EXTENSION\_get\_data**() returns an *ASN1\_OCTET\_STRING* pointer.

**X509\_supported\_extension**() returns 1 if the type of *ex* is supported by the verifier or 0 otherwise.

## SEE ALSO

ACCESS\_DESCRIPTION\_new(3), AUTHORITY\_KEYID\_new(3), BASIC\_CONSTRAINTS\_new(3), d2i\_X509\_EXTENSION(3), DIST\_POINT\_new(3), ESS\_SIGNING\_CERT\_new(3), EXTENDED\_KEY\_USAGE\_new(3), GENERAL\_NAME\_new(3), NAME\_CONSTRAINTS\_new(3), OCSP\_CRLID\_new(3), OCSP\_SERVICELOC\_new(3), PKEY\_USAGE\_PERIOD\_new(3), POLICYINFO\_new(3), TS\_REQ\_new(3), X509\_check\_ca(3), X509\_check\_host(3), X509\_check\_issued(3), X509\_get\_extension\_flags(3), X509\_REQ\_add\_extensions(3), X509V3\_EXT\_get\_nid(3), X509V3\_EXT\_print(3), X509V3\_extensions\_print(3), X509V3\_get\_d2i(3), X509v3\_get\_ext\_by\_NID(3)

## STANDARDS

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile

## HISTORY

**X509\_EXTENSION\_new**() and **X509\_EXTENSION\_free**() first appeared in SSLeay 0.6.2, **X509\_EXTENSION\_dup**() in SSLeay 0.6.5, and **X509\_EXTENSION\_create\_by\_NID**(), **X509\_EXTENSION\_create\_by\_OBJ**(), **X509\_EXTENSION\_set\_object**(), **X509\_EXTENSION\_set\_critical**(), **X509\_EXTENSION\_set\_data**(), **X509\_EXTENSION\_get\_object**(), **X509\_EXTENSION\_get\_critical**(), and **X509\_EXTENSION\_get\_data**() in SSLeay 0.8.0. These functions have been available since OpenBSD 2.4.

**X509\_supported\_extension**() first appeared in OpenSSL 0.9.7 and has been available since OpenBSD 3.2.