---
name: "libressl-X509_PUBKEY_new"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_PUBKEY_new"
---

# libressl-X509\_PUBKEY\_new(3)

X.509 SubjectPublicKeyInfo structure

## NAME

**X509\_PUBKEY\_new**, **X509\_PUBKEY\_free**, **X509\_PUBKEY\_set**, **X509\_PUBKEY\_get0**, **X509\_PUBKEY\_get**, **d2i\_X509\_PUBKEY**, **i2d\_X509\_PUBKEY**, **d2i\_PUBKEY**, **i2d\_PUBKEY**, **d2i\_PUBKEY\_bio**, **d2i\_PUBKEY\_fp**, **i2d\_PUBKEY\_fp**, **i2d\_PUBKEY\_bio**, **X509\_PUBKEY\_set0\_param**, **X509\_PUBKEY\_get0\_param** – X.509 SubjectPublicKeyInfo structure

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*X509\_PUBKEY* *\**\

**X509\_PUBKEY\_new**(*void*);

*void*\

**X509\_PUBKEY\_free**(*X509\_PUBKEY \*a*);

*int*\

**X509\_PUBKEY\_set**(*X509\_PUBKEY \*\*x*, *EVP\_PKEY \*pkey*);

*EVP\_PKEY* *\**\

**X509\_PUBKEY\_get0**(*X509\_PUBKEY \*key*);

*EVP\_PKEY* *\**\

**X509\_PUBKEY\_get**(*X509\_PUBKEY \*key*);

*X509\_PUBKEY* *\**\

**d2i\_X509\_PUBKEY**(*X509\_PUBKEY \*\*val\_out*, *const unsigned char \*\*der\_in*, *long length*);

*int*\

**i2d\_X509\_PUBKEY**(*X509\_PUBKEY \*val\_in*, *unsigned char \*\*der\_out*);

*EVP\_PKEY* *\**\

**d2i\_PUBKEY**(*EVP\_PKEY \*\*val\_out*, *const unsigned char \*\*der\_in*, *long length*);

*int*\

**i2d\_PUBKEY**(*EVP\_PKEY \*val\_in*, *unsigned char \*\*der\_out*);

*EVP\_PKEY* *\**\

**d2i\_PUBKEY\_bio**(*BIO \*bp*, *EVP\_PKEY \*\*val\_out*);

*EVP\_PKEY* *\**\

**d2i\_PUBKEY\_fp**(*FILE \*fp*, *EVP\_PKEY \*\*val\_out*);

*int*\

**i2d\_PUBKEY\_fp**(*FILE \*fp*, *EVP\_PKEY \*val\_in*);

*int*\

**i2d\_PUBKEY\_bio**(*BIO \*bp*, *EVP\_PKEY \*val\_in*);

*int*\

**X509\_PUBKEY\_set0\_param**(*X509\_PUBKEY \*pub*, *ASN1\_OBJECT \*aobj*, *int ptype*, *void \*pval*, *unsigned char \*penc*, *int penclen*);

*int*\

**X509\_PUBKEY\_get0\_param**(*ASN1\_OBJECT \*\*ppkalg*, *const unsigned char \*\*pk*, *int \*ppklen*, *X509\_ALGOR \*\*pa*, *X509\_PUBKEY \*pub*);

## DESCRIPTION

The *X509\_PUBKEY* structure represents the ASN.1 *SubjectPublicKeyInfo* structure defined in RFC 5280 section 4.1 and used in certificates and certificate requests.

**X509\_PUBKEY\_new**() allocates and initializes an *X509\_PUBKEY* structure.

**X509\_PUBKEY\_free**() frees up the *X509\_PUBKEY* structure *a*. If *a* is a NULL pointer, no action occurs.

**X509\_PUBKEY\_set**() sets the public key in \**x* to the public key contained in the *EVP\_PKEY* structure *pkey*. If \**x* is not NULL, any existing public key structure will be freed.

**X509\_PUBKEY\_get0**() returns the public key contained in *key*. The returned value is an internal pointer which must not be freed after use.

**X509\_PUBKEY\_get**() is similar to **X509\_PUBKEY\_get0**() except that the reference count on the returned key is incremented so it must be freed using EVP\_PKEY\_free(3) after use.

**d2i\_X509\_PUBKEY**(), **i2d\_X509\_PUBKEY**(), **d2i\_PUBKEY**(), and **i2d\_PUBKEY**() decode and encode an ASN.1 *SubjectPublicKeyInfo* structure using either the *X509\_PUBKEY* or the *EVP\_PKEY* object type, respectively. For details about the semantics, examples, caveats, and bugs, see ASN1\_item\_d2i(3). **d2i\_PUBKEY\_bio**(), **d2i\_PUBKEY\_fp**(), **i2d\_PUBKEY\_bio**() and **i2d\_PUBKEY\_fp**() are similar to **d2i\_PUBKEY**() and **i2d\_PUBKEY**() except they decode or encode using a *BIO* or *FILE* pointer.

**X509\_PUBKEY\_set0\_param**() sets the public key parameters of *pub*. The OID associated with the algorithm is set to *aobj*. The type of the algorithm parameters is set to *ptype* using the structure *pval*. The encoding of the public key itself is set to the *penclen* bytes contained in buffer *penc*. On success ownership of all the supplied parameters is passed to *pub* so they must not be freed after the call.

**X509\_PUBKEY\_get0\_param**() retrieves the public key parameters from *pub*, \**ppkalg* is set to the associated OID and the encoding consists of \**ppklen* bytes at \**pk*, and \**pa* is set to the associated *AlgorithmIdentifier* for the public key. If the value of any of these parameters is not required, it can be set to NULL. All of the retrieved pointers are internal and must not be freed after the call.

## RETURN VALUES

If the allocation fails, **X509\_PUBKEY\_new**() returns NULL and sets an error code that can be obtained by ERR\_get\_error(3). Otherwise it returns a pointer to the newly allocated structure.

**X509\_PUBKEY\_get0**() returns an internal pointer or NULL if an error occurs.

**X509\_PUBKEY\_get**() returns a pointer to an object that had its reference count incremented or NULL if an error occurs.

**d2i\_X509\_PUBKEY**(), **d2i\_PUBKEY**(), **d2i\_PUBKEY\_bio**(), and **d2i\_PUBKEY\_fp**() return a pointer to a valid object or NULL if an error occurs.

**i2d\_X509\_PUBKEY**() and **i2d\_PUBKEY**() return the number of bytes successfully encoded or a negative value if an error occurs.

**X509\_PUBKEY\_set**(), **X509\_PUBKEY\_set0\_param**(), **X509\_PUBKEY\_get0\_param**(), **i2d\_PUBKEY\_fp**(), and **i2d\_PUBKEY\_bio**() return 1 for success and 0 if an error occurred.

## ERRORS

After failure of **X509\_PUBKEY\_get0**() or **X509\_PUBKEY\_get**(), one of the following diagnostics can be retrieved with ERR\_get\_error(3), ERR\_GET\_REASON(3), and ERR\_reason\_error\_string(3):

- X509\_R\_UNSUPPORTED\_ALGORITHM "unsupported algorithm"

  The public key uses an algorithm unsupported by EVP\_PKEY\_set\_type(3).

- X509\_R\_METHOD\_NOT\_SUPPORTED "method not supported"

  While the algorithm is known to EVP\_PKEY\_set\_type(3), using it for decoding is not supported.

- X509\_R\_PUBLIC\_KEY\_DECODE\_ERROR "public key decode error"

  Decoding the public key failed.

- ERR\_R\_MALLOC\_FAILURE "malloc failure"

  Memory was exhausted when trying to allocate the new *EVP\_PKEY* object.

If *key* is NULL or does not contain a public key, these functions fail but no error is pushed onto the stack.

## SEE ALSO

d2i\_X509(3), X509\_ALGOR\_new(3), X509\_get\_pubkey(3), X509\_new(3)

## STANDARDS

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile

## HISTORY

**X509\_PUBKEY\_new**() and **X509\_PUBKEY\_free**() appeared in SSLeay 0.4 or earlier. **d2i\_X509\_PUBKEY**() and **i2d\_X509\_PUBKEY**() first appeared in SSLeay 0.5.1. **X509\_PUBKEY\_set**() and **X509\_PUBKEY\_get**() first appeared in SSLeay 0.8.0. These functions have been available since OpenBSD 2.4.

**d2i\_PUBKEY**() and **i2d\_PUBKEY**() first appeared in OpenSSL 0.9.5 and have been available since OpenBSD 2.7.

**d2i\_PUBKEY\_bio**(), **d2i\_PUBKEY\_fp**(), **i2d\_PUBKEY\_fp**(), and **i2d\_PUBKEY\_bio**() first appeared in OpenSSL 0.9.6 and have been available since OpenBSD 2.9.

**X509\_PUBKEY\_set0\_param**() and **X509\_PUBKEY\_get0\_param**() first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9.

**X509\_PUBKEY\_get0**() first appeared in OpenSSL 1.1.0 and has been available since OpenBSD 6.3.