---
name: "libressl-X509_VERIFY_PARAM_new"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_VERIFY_PARAM_new"
---

# libressl-X509\_VERIFY\_PARAM\_new(3)

X509 verification parameter objects

## NAME

**X509\_VERIFY\_PARAM\_new**, **X509\_VERIFY\_PARAM\_inherit**, **X509\_VERIFY\_PARAM\_set1**, **X509\_VERIFY\_PARAM\_free**, **X509\_VERIFY\_PARAM\_add0\_table**, **X509\_VERIFY\_PARAM\_lookup**, **X509\_VERIFY\_PARAM\_get\_count**, **X509\_VERIFY\_PARAM\_get0**, **X509\_VERIFY\_PARAM\_table\_cleanup** – X509 verification parameter objects

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509\_vfy.h\>**

*X509\_VERIFY\_PARAM* *\**\

**X509\_VERIFY\_PARAM\_new**(*void*);

*int*\

**X509\_VERIFY\_PARAM\_inherit**(*X509\_VERIFY\_PARAM \*destination*, *const X509\_VERIFY\_PARAM \*source*);

*int*\

**X509\_VERIFY\_PARAM\_set1**(*X509\_VERIFY\_PARAM \*destination*, *const X509\_VERIFY\_PARAM \*source*);

*void*\

**X509\_VERIFY\_PARAM\_free**(*X509\_VERIFY\_PARAM \*param*);

*int*\

**X509\_VERIFY\_PARAM\_add0\_table**(*X509\_VERIFY\_PARAM \*param*);

*const* *X509\_VERIFY\_PARAM* *\**\

**X509\_VERIFY\_PARAM\_lookup**(*const char \*name*);

*int*\

**X509\_VERIFY\_PARAM\_get\_count**(*void*);

*const* *X509\_VERIFY\_PARAM* *\**\

**X509\_VERIFY\_PARAM\_get0**(*int id*);

*void*\

**X509\_VERIFY\_PARAM\_table\_cleanup**(*void*);

## DESCRIPTION

**X509\_VERIFY\_PARAM\_new**() allocates and initializes an empty *X509\_VERIFY\_PARAM* object.

**X509\_VERIFY\_PARAM\_inherit**() copies some data from the *source* object to the *destination* object.

The verification flags set with X509\_VERIFY\_PARAM\_set\_flags(3) in the *source* object are always OR'ed into the verification flags of the *destination* object.

Fields having their default value in the *source* object are not copied.

By default, fields in the *destination* object already having a non-default value are not overwritten. However, if at least one of the *source* or *destination* objects was created during a call to X509\_STORE\_CTX\_init(3) that did not have a *store* argument, and if that object was not previously used as the *destination* in an earlier call to **X509\_VERIFY\_PARAM\_inherit**(), this restriction is waived and even non-default fields in the *destination* object get overwritten. If fields overwritten in this way contain pointers to allocated memory, that memory is freed.

As far as permitted by the above rules, the following fields are copied:

- the verification purpose identifier set with X509\_VERIFY\_PARAM\_set\_purpose(3)

- the trust setting set with X509\_VERIFY\_PARAM\_set\_trust(3)

- the verification time set with X509\_VERIFY\_PARAM\_set\_time(3); in this case, the only condition is that X509\_V\_FLAG\_USE\_CHECK\_TIME is not set in the *destination* object, whereas the time value in the *destination* object is not inspected before overwriting it

- the acceptable policy set with X509\_VERIFY\_PARAM\_set1\_policies(3)

- the maximum verification depth set with X509\_VERIFY\_PARAM\_set\_depth(3)

- flags that were set with X509\_VERIFY\_PARAM\_set\_hostflags(3)

- the list of expected DNS hostnames built with X509\_VERIFY\_PARAM\_set1\_host(3) and X509\_VERIFY\_PARAM\_add1\_host(3)

- the expected RFC 822 email address set with X509\_VERIFY\_PARAM\_set1\_email(3)

- the expected IP address set with X509\_VERIFY\_PARAM\_set1\_ip(3) or X509\_VERIFY\_PARAM\_set1\_ip\_asc(3)

Some data that may be contained in the *source* object is never copied, for example the subject name of the peer certificate that can be retrieved with X509\_VERIFY\_PARAM\_get0\_peername(3).

If *source* is a NULL pointer, the function has no effect but returns successfully.

**X509\_VERIFY\_PARAM\_set1**() is identical to **X509\_VERIFY\_PARAM\_inherit**() except that fields in the *destination* object are overwritten even if they do not match their default values. Still, fields having their default value in the *source* object are not copied.

If **X509\_VERIFY\_PARAM\_inherit**() or **X509\_VERIFY\_PARAM\_set1**() fail, partial copying may have occurred, so all data in the *destination* object should be regarded as invalid.

**X509\_VERIFY\_PARAM\_inherit**() is used internally by X509\_STORE\_CTX\_init(3) and by X509\_STORE\_CTX\_set\_default(3), and **X509\_VERIFY\_PARAM\_set1**() is used internally by X509\_STORE\_set1\_param(3).

**X509\_VERIFY\_PARAM\_free**() clears all data contained in *param* and releases all memory used by it. If *param* is a NULL pointer, no action occurs.

**X509\_VERIFY\_PARAM\_add0\_table**() adds *param* to a static list of *X509\_VERIFY\_PARAM* objects maintained by the library. This function is extremely dangerous because contrary to the name of the function, if the list already contains an object that happens to have the same name, that old object is not only silently removed from the list, but also silently freed, which may silently invalidate various pointers existing elsewhere in the program.

**X509\_VERIFY\_PARAM\_lookup**() searches this list for an object of the given *name*. If no match is found, the predefined objects built-in to the library are also inspected.

**X509\_VERIFY\_PARAM\_get\_count**() returns the sum of the number of objects on this list and the number of predefined objects built-in to the library. Note that this is not necessarily the total number of *X509\_VERIFY\_PARAM* objects existing in the program because there may be additional such objects that were never added to the list.

**X509\_VERIFY\_PARAM\_get0**() accesses predefined and user-defined objects using *id* as an index, useful for looping over objects without knowing their names. An argument less than the number of predefined objects selects one of the predefined objects; a higher argument selects an object from the list.

**X509\_VERIFY\_PARAM\_table\_cleanup**() deletes all objects from this list. It is extremely dangerous because it also invalidates all data that was contained in all objects that were on the list and because it frees all these objects, which may invalidate various pointers existing elsewhere in the program.

## RETURN VALUES

**X509\_VERIFY\_PARAM\_new**() returns a pointer to the new object, or NULL on allocation failure.

**X509\_VERIFY\_PARAM\_inherit**(), **X509\_VERIFY\_PARAM\_set1**(), and **X509\_VERIFY\_PARAM\_add0\_table**() return 1 for success or 0 for failure.

**X509\_VERIFY\_PARAM\_lookup**() and **X509\_VERIFY\_PARAM\_get0**() return a pointer to an existing built-in or user-defined object, or NULL if no object with the given *name* is found, or if *id* is at least **X509\_VERIFY\_PARAM\_get\_count**().

**X509\_VERIFY\_PARAM\_get\_count**() returns a number of objects.

## SEE ALSO

SSL\_set1\_param(3), X509\_STORE\_CTX\_set0\_param(3), X509\_STORE\_set1\_param(3), X509\_verify\_cert(3), X509\_VERIFY\_PARAM\_set\_flags(3)

## HISTORY

**X509\_VERIFY\_PARAM\_new**(), **X509\_VERIFY\_PARAM\_inherit**(), **X509\_VERIFY\_PARAM\_set1**(), **X509\_VERIFY\_PARAM\_free**(), **X509\_VERIFY\_PARAM\_add0\_table**(), **X509\_VERIFY\_PARAM\_lookup**(), and **X509\_VERIFY\_PARAM\_table\_cleanup**() first appeared in OpenSSL 0.9.8 and have been available since OpenBSD 4.5.

**X509\_VERIFY\_PARAM\_get\_count**() and **X509\_VERIFY\_PARAM\_get0**() first appeared in OpenSSL 1.0.2 and have been available since OpenBSD 6.3.