---
name: "libressl-X509_get0_signature"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_get0_signature"
---

# libressl-X509\_get0\_signature(3)

signature information

## NAME

**X509\_get0\_signature**, **X509\_REQ\_get0\_signature**, **X509\_CRL\_get0\_signature**, **X509\_get0\_tbs\_sigalg**, **X509\_CRL\_get0\_tbs\_sigalg**, **X509\_get\_signature\_type**, **X509\_get\_signature\_nid**, **X509\_REQ\_get\_signature\_nid**, **X509\_CRL\_get\_signature\_nid**, **X509\_get\_signature\_info** – signature information

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*void*\

**X509\_get0\_signature**(*const ASN1\_BIT\_STRING \*\*psig*, *const X509\_ALGOR \*\*palg*, *const X509 \*x*);

*void*\

**X509\_REQ\_get0\_signature**(*const X509\_REQ \*req*, *const ASN1\_BIT\_STRING \*\*psig*, *const X509\_ALGOR \*\*palg*);

*void*\

**X509\_CRL\_get0\_signature**(*const X509\_CRL \*crl*, *const ASN1\_BIT\_STRING \*\*psig*, *const X509\_ALGOR \*\*palg*);

*const* *X509\_ALGOR* *\**\

**X509\_get0\_tbs\_sigalg**(*const X509 \*x*);

*const* *X509\_ALGOR* *\**\

**X509\_CRL\_get0\_tbs\_sigalg**(*const X509\_CRL \*crl*);

*int*\

**X509\_get\_signature\_type**(*const X509 \*x*);

*int*\

**X509\_get\_signature\_nid**(*const X509 \*x*);

*int*\

**X509\_REQ\_get\_signature\_nid**(*const X509\_REQ \*req*);

*int*\

**X509\_CRL\_get\_signature\_nid**(*const X509\_CRL \*crl*);

*int*\

**X509\_get\_signature\_info**(*X509 \*x*, *int \*md\_nid*, *int \*pkey\_nid*, *int \*security\_bits*, *uint32\_t \*flags*);

## DESCRIPTION

**X509\_get0\_signature**(), **X509\_REQ\_get0\_signature**(), and **X509\_CRL\_get0\_signature**() set \**psig* to the signature and \**palg* to the signature algorithm of *x*, *req*, or *crl*, respectively. **X509\_get0\_tbs\_sigalg**() and **X509\_CRL\_get0\_tbs\_sigalg**() return the signature algorithm in the signed portion of *x* or *crl*, respectively. The values returned are internal pointers that must not be freed by the caller.

**X509\_get\_signature\_type**() returns the base NID corresponding to the signature algorithm of *x* just like EVP\_PKEY\_base\_id(3) does.

**X509\_get\_signature\_nid**(), **X509\_REQ\_get\_signature\_nid**(), and **X509\_CRL\_get\_signature\_nid**() return the NID corresponding to the signature algorithm of *x*, *req*, or *crl*, respectively, just like EVP\_PKEY\_id(3) does.

**X509\_get\_signature\_info**() retrieves information about the signature of certificate *x*. The NID of the digest algorithm is written to \**md\_nid*, the public key algorithm to \**pkey\_nid*, the effective security bits to \**security\_bits*, and flag details to \**flags*. Any of the output parameters can be set to NULL if the information is not required. If *flags* is not a NULL pointer, \**flags* is set to the bitwise OR of:

- X509\_SIG\_INFO\_VALID

  No error occurred. This flag is set if **X509\_get\_signature\_info**() returns 1.

- X509\_SIG\_INFO\_TLS

  The signature algorithm is appropriate for use in TLS. For a supported EdDSA algorithm (in LibreSSL this is Ed25519) this flag is always set. For an RSASSA-PSS PSS algorithm this flag is set if the parameters are DER encoded, the digest algorithm is one of SHA-256, SHA-384, or SHA-512, the same digest algorithm is used in the mask generation function, and the salt length is equal to the digest algorithm's output length. For all other signature algorithms this flag is set if the digest algorithm is one of SHA-1, SHA-256, SHA-384, or SHA-512.

**X509\_get\_signature\_info**() returns 1 on success and 0 on failure. Failure conditions include unsupported signature algorithms, certificate parsing errors and memory allocation failure.

These functions provide lower level access to the signature for cases where an application wishes to analyse or generate a signature in a form where X509\_sign(3) is not appropriate, for example in a non-standard or unsupported format.

## SEE ALSO

EVP\_PKEY\_base\_id(3), OBJ\_obj2nid(3), X509\_ALGOR\_new(3), X509\_CRL\_get0\_by\_serial(3), X509\_CRL\_new(3), X509\_get\_pubkey(3), X509\_get\_subject\_name(3), X509\_get\_version(3), X509\_new(3), X509\_REQ\_new(3), X509\_sign(3), X509\_signature\_dump(3), X509\_verify\_cert(3)

## HISTORY

**X509\_get\_signature\_type**() first appeared in SSLeay 0.8.0 and has been available since OpenBSD 2.4.

**X509\_get0\_signature**() and **X509\_get\_signature\_nid**() first appeared in OpenSSL 1.0.2. **X509\_REQ\_get0\_signature**(), **X509\_CRL\_get0\_signature**(), **X509\_get0\_tbs\_sigalg**(), **X509\_REQ\_get\_signature\_nid**(), and **X509\_CRL\_get\_signature\_nid**() first appeared in OpenSSL 1.1.0. All these functions have been available since OpenBSD 6.3.

**X509\_CRL\_get0\_tbs\_sigalg**() first appeared in LibreSSL 3.7.1 and has been available since OpenBSD 7.3.

**X509\_get\_signature\_info**() first appeared in OpenSSL 1.1.1 and has been available since OpenBSD 7.6.

## CAVEATS

The security bits returned by **X509\_get\_signature\_info**() refer to the information available from the certificate signature (such as the signing digest). In some cases the actual security of the signature is smaller because the signing key is less secure. For example in a certificate signed using SHA-512 and a 1024-bit RSA key.

## BUGS

The signatures of **X509\_get0\_signature**(), **X509\_REQ\_get0\_signature**(), and **X509\_CRL\_get0\_signature**() are inconsistent.