---
name: "libressl-X509_NAME_get_index_by_NID"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_NAME_get_index_by_NID"
---

# libressl-X509\_NAME\_get\_index\_by\_NID(3)

X509\_NAME lookup and enumeration functions

## NAME

**X509\_NAME\_get\_index\_by\_NID**, **X509\_NAME\_get\_index\_by\_OBJ**, **X509\_NAME\_entry\_count**, **X509\_NAME\_get\_entry**, **X509\_NAME\_get\_text\_by\_NID**, **X509\_NAME\_get\_text\_by\_OBJ** – X509\_NAME lookup and enumeration functions

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*int*\

**X509\_NAME\_get\_index\_by\_NID**(*const X509\_NAME \*name*, *int nid*, *int lastpos*);

*int*\

**X509\_NAME\_get\_index\_by\_OBJ**(*const X509\_NAME \*name*, *const ASN1\_OBJECT \*obj*, *int lastpos*);

*int*\

**X509\_NAME\_entry\_count**(*const X509\_NAME \*name*);

*X509\_NAME\_ENTRY* *\**\

**X509\_NAME\_get\_entry**(*const X509\_NAME \*name*, *int loc*);

*int*\

**X509\_NAME\_get\_text\_by\_NID**(*X509\_NAME \*name*, *int nid*, *char \*buf*, *int len*);

*int*\

**X509\_NAME\_get\_text\_by\_OBJ**(*X509\_NAME \*name*, *const ASN1\_OBJECT \*obj*, *char \*buf*, *int len*);

## DESCRIPTION

These functions allow an *X509\_NAME* structure to be examined. The *X509\_NAME* structure is the same as the ASN.1 *Name* type defined in RFC 2459 (and elsewhere) and used, for example, in certificate subject and issuer names.

**X509\_NAME\_get\_index\_by\_NID**() and **X509\_NAME\_get\_index\_by\_OBJ**() retrieve the next index matching *nid* or *obj* after *lastpos*. *lastpos* should initially be set to -1.

**X509\_NAME\_get\_entry**() retrieves the *X509\_NAME\_ENTRY* from *name* corresponding to index *loc*. Acceptable values for *loc* run from 0 to **X509\_NAME\_entry\_count**(*name*) - 1.

**X509\_NAME\_get\_text\_by\_NID**() and **X509\_NAME\_get\_text\_by\_OBJ**() retrieve the bytes encoded as UTF-8 from the first entry in *name* which matches *nid* or *obj*. If *buf* is NULL, nothing is written, but the return value is calculated as usual. If *buf* is not NULL, no more than *len* bytes will be written and the text written to *buf* will be NUL terminated.

If *len* is not large enough to hold the NUL byte terminated UTF-8 encoding of the text, or if the UTF-8 encoding of the text would contains a NUL byte, no data will be written and the call will return failure.

All relevant NID\_\* and OBJ\_\* codes can be found in the ⟨openssl/objects.h⟩ header file.

Applications which could pass invalid NIDs to **X509\_NAME\_get\_index\_by\_NID**() should check for the return value of -2. Alternatively the NID validity can be determined first by checking that **OBJ\_nid2obj**(*nid*) is not NULL.

## RETURN VALUES

**X509\_NAME\_get\_index\_by\_NID**() returns the index of the next matching entry, -1 if not found, or -2 if the *nid* does not correspond to a valid OID.

**X509\_NAME\_get\_index\_by\_OBJ**() returns the index of the next matching entry or -1 if not found.

**X509\_NAME\_entry\_count**() returns the total number of entries in *name*.

**X509\_NAME\_get\_entry**() returns an internal pointer which must not be freed by the caller or NULL if the index is invalid.

**X509\_NAME\_get\_text\_by\_NID**() and **X509\_NAME\_get\_text\_by\_OBJ**() return the length of the output UTF-8 string written, not counting the terminating NUL, or -1 in the case of an error or no match being found.

In some cases of failure of **X509\_NAME\_get\_index\_by\_NID**() and **X509\_NAME\_get\_text\_by\_NID**(), the reason can be determined with ERR\_get\_error(3).

## EXAMPLES

Process all entries:

```
int i;
X509_NAME_ENTRY *e;
for (i = 0; i < X509_NAME_entry_count(nm); i++) {
	e = X509_NAME_get_entry(nm, i);
	/* Do something with e */
}
```

Process all commonName entries:

```
int lastpos = -1;
X509_NAME_ENTRY *e;
for (;;) {
	lastpos = X509_NAME_get_index_by_NID(nm, NID_commonName, lastpos);
	if (lastpos == -1)
		break;
	e = X509_NAME_get_entry(nm, lastpos);
	/* Do something with e */
}
```

## SEE ALSO

d2i\_X509\_NAME(3), X509\_NAME\_ENTRY\_get\_object(3), X509\_NAME\_new(3)

## HISTORY

These functions first appeared in SSLeay 0.8.0 and have been available since OpenBSD 2.4.

## CAVEATS

**X509\_NAME\_get\_text\_by\_NID**() and **X509\_NAME\_get\_text\_by\_OBJ**() are legacy functions which have various limitations which make them of minimal use in practice. They can only find the first matching entry and will copy the contents of the field verbatim: this can be highly confusing if the target is a multicharacter string type like a *BMPString* or a *UTF8String*.

For a more general solution, **X509\_NAME\_get\_index\_by\_NID**() or **X509\_NAME\_get\_index\_by\_OBJ**() should be used, followed by **X509\_NAME\_get\_entry**() on any matching indices and then the various *X509\_NAME\_ENTRY* utility functions on the result.