---
name: "libressl-X509_cmp"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_cmp"
---

# libressl-X509\_cmp(3)

compare X.509 certificates and related values

## NAME

**X509\_cmp**, **X509\_NAME\_cmp**, **X509\_issuer\_and\_serial\_cmp**, **X509\_issuer\_name\_cmp**, **X509\_subject\_name\_cmp**, **X509\_CRL\_cmp**, **X509\_CRL\_match** – compare X.509 certificates and related values

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*int*\

**X509\_cmp**(*const X509 \*a*, *const X509 \*b*);

*int*\

**X509\_NAME\_cmp**(*const X509\_NAME \*a*, *const X509\_NAME \*b*);

*int*\

**X509\_issuer\_and\_serial\_cmp**(*const X509 \*a*, *const X509 \*b*);

*int*\

**X509\_issuer\_name\_cmp**(*const X509 \*a*, *const X509 \*b*);

*int*\

**X509\_subject\_name\_cmp**(*const X509 \*a*, *const X509 \*b*);

*int*\

**X509\_CRL\_cmp**(*const X509\_CRL \*a*, *const X509\_CRL \*b*);

*int*\

**X509\_CRL\_match**(*const X509\_CRL \*a*, *const X509\_CRL \*b*);

## DESCRIPTION

**X509\_cmp**() compares two X.509 certificates using [memcmp(3)](/memcmp/3.md) on the hashes of their canonical (DER) representations as generated with X509\_digest(3). The digest function is implementation-specific: LibreSSL uses SHA-512, other implementations use SHA-1.

**X509\_NAME\_cmp**() compares two X.501 *Name* objects using their canonical (DER) representations generated with i2d\_X509\_NAME(3).

**X509\_issuer\_and\_serial\_cmp**() compares the *issuer* and *serialNumber* fields of two *TBSCertificate* structures, using **X509\_NAME\_cmp**() for the *issuer* fields.

**X509\_issuer\_name\_cmp**() compares the *issuer* fields of two *TBSCertificate* structures using **X509\_NAME\_cmp**().

**X509\_subject\_name\_cmp**() compares the *subject* fields of two *TBSCertificate* structures using **X509\_NAME\_cmp**().

**X509\_CRL\_cmp**() is misnamed; it only compares the *issuer* fields of two *TBSCertList* structures using **X509\_NAME\_cmp**().

**X509\_CRL\_match**() compares two certificate revocation lists using [memcmp(3)](/memcmp/3.md) on the hashes of their canonical (DER) representations as generated with X509\_CRL\_digest(3). The digest function is implementation-specific: LibreSSL uses SHA-512, other implementations use SHA-1.

## RETURN VALUES

All these functions return 0 to indicate a match or a non-zero value to indicate a mismatch.

**X509\_NAME\_cmp**(), **X509\_issuer\_and\_serial\_cmp**(), **X509\_issuer\_name\_cmp**(), **X509\_subject\_name\_cmp**() and **X509\_CRL\_cmp**() may return -2 to indicate an error.

## SEE ALSO

i2d\_X509\_NAME(3), X509\_CRL\_new(3), X509\_digest(3), X509\_NAME\_new(3), X509\_new(3)

## STANDARDS

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile

- section 4.1: Basic Certificate Fields

- section 5.1: CRL Fields

## HISTORY

**X509\_issuer\_and\_serial\_cmp**(), **X509\_issuer\_name\_cmp**(), and **X509\_subject\_name\_cmp**() first appeared in SSLeay 0.5.1 and **X509\_NAME\_cmp**() and **X509\_CRL\_cmp**() in SSLeay 0.8.0. These functions have been available since OpenBSD 2.4.

**X509\_cmp**() first appeared in OpenSSL 0.9.5 and has been available since OpenBSD 2.7.

**X509\_CRL\_match**() first appeared in OpenSSL 1.0.0 and has been available since OpenBSD 4.9.

## BUGS

For **X509\_NAME\_cmp**(), **X509\_issuer\_and\_serial\_cmp**(), **X509\_issuer\_name\_cmp**(), **X509\_subject\_name\_cmp**() and **X509\_CRL\_cmp**(), the return value -2 sometimes indicates a mismatch and sometimes an error.