---
name: "libressl-X509_STORE_CTX_set_flags"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_STORE_CTX_set_flags"
---

# libressl-X509\_STORE\_CTX\_set\_flags(3)

X509\_STORE\_CTX parameter initialisation

## NAME

**X509\_STORE\_CTX\_set\_flags**, **X509\_STORE\_CTX\_set\_time**, **X509\_STORE\_CTX\_set\_depth**, **X509\_STORE\_CTX\_set\_trust**, **X509\_STORE\_CTX\_set\_purpose**, **X509\_STORE\_CTX\_get0\_param**, **X509\_STORE\_CTX\_set0\_param**, **X509\_STORE\_CTX\_set\_default** – X509\_STORE\_CTX parameter initialisation

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509\_vfy.h\>**

*void*\

**X509\_STORE\_CTX\_set\_flags**(*X509\_STORE\_CTX \*ctx*, *unsigned long flags*);

*void*\

**X509\_STORE\_CTX\_set\_time**(*X509\_STORE\_CTX \*ctx*, *unsigned long dummy*, *time\_t time*);

*void*\

**X509\_STORE\_CTX\_set\_depth**(*X509\_STORE\_CTX \*ctx*, *int depth*);

*int*\

**X509\_STORE\_CTX\_set\_trust**(*X509\_STORE\_CTX \*ctx*, *int trust*);

*int*\

**X509\_STORE\_CTX\_set\_purpose**(*X509\_STORE\_CTX \*ctx*, *int purpose*);

*X509\_VERIFY\_PARAM* *\**\

**X509\_STORE\_CTX\_get0\_param**(*X509\_STORE\_CTX \*ctx*);

*void*\

**X509\_STORE\_CTX\_set0\_param**(*X509\_STORE\_CTX \*ctx*, *X509\_VERIFY\_PARAM \*param*);

*int*\

**X509\_STORE\_CTX\_set\_default**(*X509\_STORE\_CTX \*ctx*, *const char \*name*);

## DESCRIPTION

These functions operate on the *X509\_VERIFY\_PARAM* object used by *ctx*. Usually, X509\_STORE\_CTX\_init(3) is called on *ctx* before these functions, and X509\_verify\_cert(3) afterwards.

**X509\_STORE\_CTX\_set\_flags**() sets the internal verification parameter flags to *flags*. See X509\_VERIFY\_PARAM\_set\_flags(3) for a description of the verification flags.

**X509\_STORE\_CTX\_set\_time**() sets the verification *time* using X509\_VERIFY\_PARAM\_set\_time(3). The *dummy* argument is ignored.

**X509\_STORE\_CTX\_set\_depth**() sets the maximum verification *depth* using X509\_VERIFY\_PARAM\_set\_depth(3). That is the maximum number of untrusted CA certificates that can appear in a chain.

**X509\_STORE\_CTX\_set\_trust**() sets the *trust* identifier that can also be set using X509\_VERIFY\_PARAM\_set\_trust(3). If the *trust* argument is 0 or invalid or the trust identifier is already set to a non-zero value in the *X509\_VERIFY\_PARAM* object, no action occurs.

**X509\_STORE\_CTX\_set\_purpose**() sets the *purpose* identifier that can also be set using X509\_VERIFY\_PARAM\_set\_purpose(3). If the *purpose* argument is 0 or any failure occurs, nothing is changed.

In the following, the trust identifier contained in the *X509\_PURPOSE* object associated with *purpose* is called the “associated trust”.

The function fails if the *purpose* argument or the associated trust is invalid but not 0; otherwise, **X509\_STORE\_CTX\_set\_purpose**() also does the equivalent of calling **X509\_STORE\_CTX\_set\_trust**() with the associated trust.

If the purpose identifier is already set to a non-zero value in the *X509\_VERIFY\_PARAM* object, it is not changed, even if the *purpose* argument is valid, too.

**X509\_STORE\_CTX\_get0\_param**() retrieves an internal pointer to the verification parameters associated with *ctx*.

**X509\_STORE\_CTX\_set0\_param**() sets the internal verification parameter pointer to *param*. After this call *param* should not be used.

**X509\_STORE\_CTX\_set\_default**() looks up and sets the default verification method to *name*. This uses the function X509\_VERIFY\_PARAM\_lookup(3) to find an appropriate set of parameters from *name* and copies them using X509\_VERIFY\_PARAM\_inherit(3).

## RETURN VALUES

**X509\_STORE\_CTX\_set\_trust**() returns 1 if the *trust* argument is 0 or valid or 0 if it is invalid but not 0. A return value of 1 does *not* imply that the trust identifier stored in the *X509\_VERIFY\_PARAM* object was changed.

**X509\_STORE\_CTX\_set\_purpose**() returns 1 if both the *purpose* argument and the associated trust are 0 or valid. It returns 0 if either the *purpose* argument or the associated trust is invalid but not 0. A return value of 1 does not imply that any data was changed.

**X509\_STORE\_CTX\_get0\_param**() returns a pointer to an *X509\_VERIFY\_PARAM* structure or NULL if an error occurred.

**X509\_STORE\_CTX\_set\_default**() returns 1 for success or 0 if an error occurred.

## ERRORS

The following diagnostics can be retrieved with ERR\_get\_error(3), ERR\_GET\_REASON(3), and ERR\_reason\_error\_string(3):

- X509\_R\_UNKNOWN\_TRUST\_ID "unknown trust id"

  **X509\_STORE\_CTX\_set\_trust**() was called with a *trust* argument that is invalid but not 0. Other implementations may also return this when **X509\_STORE\_CTX\_set\_purpose**() is called with a *purpose* argument with invalid associated trust.

- X509\_R\_UNKNOWN\_PURPOSE\_ID "unknown purpose id"

  The *purpose* argument is invalid but not 0.

The other functions provide no diagnostics.

## SEE ALSO

X509\_STORE\_CTX\_get\_error(3), X509\_STORE\_CTX\_new(3), X509\_STORE\_CTX\_set\_verify(3), X509\_STORE\_CTX\_set\_verify\_cb(3), X509\_STORE\_new(3), X509\_STORE\_set1\_param(3), X509\_STORE\_set\_verify\_cb(3), X509\_verify\_cert(3), X509\_VERIFY\_PARAM\_new(3), X509\_VERIFY\_PARAM\_set\_flags(3)

## HISTORY

**X509\_STORE\_CTX\_set\_depth**() first appeared in OpenSSL 0.9.3 and has been available since OpenBSD 2.4.

**X509\_STORE\_CTX\_set\_trust**() and **X509\_STORE\_CTX\_set\_purpose**() first appeared in OpenSSL 0.9.5 and have been available since OpenBSD 2.7.

**X509\_STORE\_CTX\_set\_flags**() and **X509\_STORE\_CTX\_set\_time**() first appeared in OpenSSL 0.9.6 and have been available since OpenBSD 2.9.

**X509\_STORE\_CTX\_get0\_param**(), **X509\_STORE\_CTX\_set0\_param**(), and **X509\_STORE\_CTX\_set\_default**() first appeared in OpenSSL 0.9.8 and have been available since OpenBSD 4.5.

## CAVEATS

The precise effect of a successful call to **X509\_STORE\_CTX\_set\_trust**() and **X509\_STORE\_CTX\_set\_purpose**() is unclear unless only one of these functions is used immediately after X509\_STORE\_CTX\_init(3). It is therefore recommended to use **X509\_STORE\_CTX\_get0\_param**(), X509\_VERIFY\_PARAM\_set\_trust(3), and X509\_VERIFY\_PARAM\_set\_purpose(3) instead.