---
name: "libressl-X509_STORE_CTX_set_verify"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_STORE_CTX_set_verify"
---

# libressl-X509\_STORE\_CTX\_set\_verify(3)

user-defined certificate chain verification function

## NAME

**X509\_STORE\_CTX\_verify\_fn**, **X509\_STORE\_CTX\_set\_verify**, **X509\_STORE\_CTX\_get\_verify**, **X509\_STORE\_set\_verify**, **X509\_STORE\_set\_verify\_func**, **X509\_STORE\_get\_verify**, **X509\_STORE\_CTX\_check\_issued\_fn**, **X509\_STORE\_set\_check\_issued**, **X509\_STORE\_get\_check\_issued**, **X509\_STORE\_CTX\_get\_check\_issued** – user-defined certificate chain verification function

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509\_vfy.h\>**

*typedef* *int*\

**(\*X509\_STORE\_CTX\_verify\_fn)**(*X509\_STORE\_CTX \*ctx*);

*void*\

**X509\_STORE\_CTX\_set\_verify**(*X509\_STORE\_CTX \*ctx*, *X509\_STORE\_CTX\_verify\_fn verify*);

*X509\_STORE\_CTX\_verify\_fn*\

**X509\_STORE\_CTX\_get\_verify**(*X509\_STORE\_CTX \*ctx*);

*void*\

**X509\_STORE\_set\_verify**(*X509\_STORE \*store*, *X509\_STORE\_CTX\_verify\_fn verify*);

*void*\

**X509\_STORE\_set\_verify\_func**(*X509\_STORE \*store*, *X509\_STORE\_CTX\_verify\_fn verify*);

*X509\_STORE\_CTX\_verify\_fn*\

**X509\_STORE\_get\_verify**(*X509\_STORE\_CTX \*ctx*);

*typedef* *int*\

**(\*X509\_STORE\_CTX\_check\_issued\_fn)**(*X509\_STORE\_CTX \*ctx*, *X509 \*subject*, *X509 \*issuer*);

*void*\

**X509\_STORE\_set\_check\_issued**(*X509\_STORE \*store*, *X509\_STORE\_CTX\_check\_issued\_fn check\_issued*);

*X509\_STORE\_CTX\_check\_issued\_fn*\

**X509\_STORE\_get\_check\_issued**(*X509\_STORE \*store*);

*X509\_STORE\_CTX\_check\_issued\_fn*\

**X509\_STORE\_CTX\_get\_check\_issued**(*X509\_STORE\_CTX \*ctx*);

## DESCRIPTION

**X509\_STORE\_CTX\_set\_verify**() configures *ctx* to use the *verify* argument as the X.509 certificate chain verification function instead of the default verification function built into the library when X509\_verify\_cert(3) is called.

The *verify* function provided by the user is only called if the X509\_V\_FLAG\_LEGACY\_VERIFY or X509\_V\_FLAG\_NO\_ALT\_CHAINS flag was set on *ctx* using X509\_STORE\_CTX\_set\_flags(3) or X509\_VERIFY\_PARAM\_set\_flags(3). Otherwise, it is ignored and a different algorithm is used that does not support replacing the verification function.

**X509\_STORE\_set\_verify**() saves the function pointer *verify* in the given *store* object. That pointer will be copied to an *X509\_STORE\_CTX* object when *store* is later passed as an argument to X509\_STORE\_CTX\_init(3).

**X509\_STORE\_set\_verify\_func**() is an alias for **X509\_STORE\_set\_verify**() implemented as a macro.

**X509\_STORE\_set\_check\_issued**() saves the function pointer *check\_issued* in the given *store* object. That pointer will be copied to an *X509\_STORE\_CTX* object when *store* is later passed as an argument to **X509\_STORE\_CTX\_init**(*3*).

The *check\_issued* function provided by the user should check whether a given certificate *subject* was issued using the CA certificate *issuer*, and must return 0 on failure and 1 on success. The default implementation ignores the *ctx* argument and returns success if and only if X509\_check\_issued(3) returns X509\_V\_OK. It is important to pay close attention to the order of the *issuer* and *subject* arguments. In X509\_check\_issued(3) the *issuer* precedes the *subject* while in **check\_issued**() the *subject* comes first.

## RETURN VALUES

**X509\_STORE\_CTX\_verify\_fn**() is supposed to return 1 to indicate that the chain is valid or 0 if it is not or if an error occurred.

**X509\_STORE\_CTX\_get\_verify**() returns a function pointer previously set with **X509\_STORE\_CTX\_set\_verify**() or X509\_STORE\_CTX\_init(3), or NULL if *ctx* is uninitialized.

**X509\_STORE\_get\_verify**() returns the function pointer previously set with **X509\_STORE\_set\_verify**(), or NULL if that function was not called on the *store*.

**X509\_STORE\_get\_check\_issued**() returns the function pointer previously set with **X509\_STORE\_set\_check\_issued**(), or NULL if that function was not called on the *store*.

**X509\_STORE\_CTX\_get\_check\_issued**() returns the **check\_issued**() function pointer set on the *X509\_STORE\_CTX*. This is either the **check\_issued**() function inherited from the *store* used in X509\_STORE\_CTX\_init(3) or the library's default implementation.

## SEE ALSO

X509\_check\_issued(3), X509\_STORE\_CTX\_init(3), X509\_STORE\_CTX\_set\_error(3), X509\_STORE\_CTX\_set\_flags(3), X509\_STORE\_CTX\_set\_verify\_cb(3), X509\_STORE\_new(3), X509\_STORE\_set\_flags(3), X509\_STORE\_set\_verify\_cb(3), X509\_verify\_cert(3), X509\_VERIFY\_PARAM\_set\_flags(3)

## HISTORY

**X509\_STORE\_set\_verify\_func**() first appeared in SSLeay 0.8.0 and has been available since OpenBSD 2.4.

**X509\_STORE\_CTX\_set\_verify**() and **X509\_STORE\_CTX\_get\_verify**() first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 7.1.

**X509\_STORE\_CTX\_verify\_fn**(), **X509\_STORE\_set\_verify**(), and **X509\_STORE\_get\_verify**() first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 7.2.

**X509\_STORE\_set\_check\_issued**(), **X509\_STORE\_get\_check\_issued**(), and **X509\_STORE\_CTX\_get\_check\_issued**() first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 7.3.

## BUGS

The reversal of order of *subject* and *issuer* between **check\_issued**() and X509\_check\_issued(3) is very confusing. It has led to bugs and will cause many more.