---
name: "libressl-X509_add1_trust_object"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_add1_trust_object"
---

# libressl-X509\_add1\_trust\_object(3)

mark an X.509 certificate as intended for a specific purpose

## NAME

**X509\_add1\_trust\_object**, **X509\_trust\_clear**, **X509\_add1\_reject\_object**, **X509\_reject\_clear** – mark an X.509 certificate as intended for a specific purpose

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*int*\

**X509\_add1\_trust\_object**(*X509 \*x*, *const ASN1\_OBJECT \*purpose*);

*void*\

**X509\_trust\_clear**(*X509 \*x*);

*int*\

**X509\_add1\_reject\_object**(*X509 \*x*, *const ASN1\_OBJECT \*purpose*);

*void*\

**X509\_reject\_clear**(*X509 \*x*);

## DESCRIPTION

**X509\_add1\_trust\_object**() appends a deep copy of the *purpose* object to the set of intended purposes that *x* contains as non-standard auxiliary data. The function OBJ\_nid2obj(3) can be used to create appropriate purpose objects from the NID\_\* constants mentioned in X509\_check\_purpose(3), even though the X509\_PURPOSE\_\* constants listed in that manual page are not intended for use with **X509\_add1\_trust\_object**().

**X509\_trust\_clear**() frees and removes all purpose objects from the set of intended purposes in the non-standard auxiliary data of *x*.

**X509\_add1\_reject\_object**() and **X509\_reject\_clear**() are similar except that they operate on a set of unintended purposes.

As an alternative to using the functions documented in the present manual page, X.509 certificate extensions can be used. At the price of higher complexity, those allow storing the purpose inside the certificate itself in a standard-conforming way rather than merely in non-standard auxiliary data associated with the certificate. See EXTENDED\_KEY\_USAGE\_new(3) for details.

## RETURN VALUES

**X509\_add1\_trust\_object**() and **X509\_add1\_reject\_object**() return the new number of purposes in the respective set or 0 if an error occurs, in particular if memory allocation fails or if *x* does not contain a sub-object that can hold non-standard auxiliary data.

## SEE ALSO

ASN1\_OBJECT\_new(3), EXTENDED\_KEY\_USAGE\_new(3), OBJ\_nid2obj(3), X509\_CERT\_AUX\_new(3), X509\_new(3)

## HISTORY

These functions first appeared in OpenSSL 0.9.4 and have been available since OpenBSD 2.7.