---
name: "libressl-X509_check_ca"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_check_ca"
---

# libressl-X509\_check\_ca(3)

check whether a certificate is a CA certificate

## NAME

**X509\_check\_ca** – check whether a certificate is a CA certificate

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509v3.h\>**

*int*\

**X509\_check\_ca**(*X509 \*cert*);

## DESCRIPTION

The **X509\_check\_ca**() function checks whether the given certificate is a CA certificate, that is, whether it can be used to sign other certificates.

## RETURN VALUES

If *cert* is a CA certificate, a non-zero value is returned; 0 otherwise.

The following return values identify specific kinds of CA certificates:

- 1

  an X.509 v3 CA certificate with **basicConstraints** extension CA:TRUE

- 3

  a self-signed X.509 v1 certificate

- 4

  a certificate with **keyUsage** extension with bit **keyCertSign** set, but without **basicConstraints**

- 5

  a certificate with an outdated Netscape Certificate Type extension telling that it is a CA certificate

## SEE ALSO

BASIC\_CONSTRAINTS\_new(3), EXTENDED\_KEY\_USAGE\_new(3), X509\_check\_issued(3), X509\_check\_purpose(3), X509\_EXTENSION\_new(3), X509\_new(3), X509\_verify\_cert(3)

## HISTORY

**X509\_check\_ca**() first appeared in OpenSSL 0.9.7f and has been available since OpenBSD 3.8.

## BUGS

If **X509\_check\_ca**() fails to cache X509v3 extension values, it may fail to recognize a CA certificate. An application should call X509\_check\_purpose(3) with a *purpose* argument of -1, ensuring that the X509v3 extensions are cached, before calling **X509\_check\_ca**().