---
name: "libressl-X509_get_extension_flags"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_get_extension_flags"
---

# libressl-X509\_get\_extension\_flags(3)

retrieve certificate extension data

## NAME

**X509\_get\_extension\_flags**, **X509\_get\_key\_usage**, **X509\_get\_extended\_key\_usage** – retrieve certificate extension data

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509v3.h\>**

*uint32\_t*\

**X509\_get\_extension\_flags**(*X509 \*x*);

*uint32\_t*\

**X509\_get\_key\_usage**(*X509 \*x*);

*uint32\_t*\

**X509\_get\_extended\_key\_usage**(*X509 \*x*);

## DESCRIPTION

These functions retrieve information related to commonly used certificate extensions.

**X509\_get\_extension\_flags**() retrieves general information about a certificate. It returns one or more of the following flags OR'ed together.

- EXFLAG\_V1

  The certificate is an obsolete version 1 certificate.

- EXFLAG\_BCONS

  The certificate contains a basic constraints extension.

- EXFLAG\_CA

  The certificate contains basic constraints and asserts the CA flag.

- EXFLAG\_PROXY

  The certificate is a valid proxy certificate. In LibreSSL this flag is never set.

- EXFLAG\_SI

  The certificate is self issued (that is subject and issuer names match).

- EXFLAG\_SS

  The subject and issuer names match and extension values imply it is self signed.

- EXFLAG\_FRESHEST

  The freshest CRL extension is present in the certificate.

- EXFLAG\_CRITICAL

  The certificate contains an unhandled critical extension.

- EXFLAG\_INVALID

  Some certificate extension values are invalid or inconsistent. The certificate should be rejected. This bit may also be raised after an out-of-memory error while processing the X509 object, so it may not be related to the processed ASN1 object itself.

- EXFLAG\_INVALID\_POLICY

  The NID\_certificate\_policies certificate extension is invalid or inconsistent. The certificate should be rejected. This bit may also be raised after an out-of-memory error while processing the X509 object, so it may not be related to the processed ASN1 object itself.

- EXFLAG\_KUSAGE

  The certificate contains a key usage extension. The value can be retrieved using **X509\_get\_key\_usage**().

- EXFLAG\_XKUSAGE

  The certificate contains an extended key usage extension. The value can be retrieved using **X509\_get\_extended\_key\_usage**().

**X509\_get\_key\_usage**() returns the value of the key usage extension. If key usage is present, it returns zero or more of these flags: KU\_DIGITAL\_SIGNATURE, KU\_NON\_REPUDIATION, KU\_KEY\_ENCIPHERMENT, KU\_DATA\_ENCIPHERMENT, KU\_KEY\_AGREEMENT, KU\_KEY\_CERT\_SIGN, KU\_CRL\_SIGN, KU\_ENCIPHER\_ONLY, or KU\_DECIPHER\_ONLY, corresponding to individual key usage bits. If key usage is absent, UINT32\_MAX is returned.

The following aliases for these flags are defined in ⟨openssl/x509.h⟩: X509v3\_KU\_DIGITAL\_SIGNATURE, X509v3\_KU\_NON\_REPUDIATION, X509v3\_KU\_KEY\_ENCIPHERMENT, X509v3\_KU\_DATA\_ENCIPHERMENT, X509v3\_KU\_KEY\_AGREEMENT, X509v3\_KU\_KEY\_CERT\_SIGN, X509v3\_KU\_CRL\_SIGN, X509v3\_KU\_ENCIPHER\_ONLY, and X509v3\_KU\_DECIPHER\_ONLY.

**X509\_get\_extended\_key\_usage**() returns the value of the extended key usage extension. If extended key usage is present, it returns zero or more of these flags: XKU\_SSL\_SERVER, XKU\_SSL\_CLIENT, XKU\_SMIME, XKU\_CODE\_SIGN XKU\_OCSP\_SIGN, XKU\_TIMESTAMP, XKU\_DVCS, or XKU\_ANYEKU. These correspond to the OIDs "id-kp-serverAuth", "id-kp-clientAuth", "id-kp-emailProtection", "id-kp-codeSigning", "id-kp-OCSPSigning", "id-kp-timeStamping", "id-kp-dvcs", and "anyExtendedKeyUsage", respectively. Additionally, XKU\_SGC is set if either Netscape or Microsoft SGC OIDs are present.

The value of the flags correspond to extension values which are cached in the *X509* structure. If the flags returned do not provide sufficient information, an application should examine extension values directly, for example using X509\_get\_ext\_d2i(3).

If the key usage or extended key usage extension is absent then typically usage is unrestricted. For this reason **X509\_get\_key\_usage**() and **X509\_get\_extended\_key\_usage**() return UINT32\_MAX when the corresponding extension is absent. Applications can additionally check the return value of **X509\_get\_extension\_flags**() and take appropriate action if an extension is absent.

## RETURN VALUES

**X509\_get\_extension\_flags**(), **X509\_get\_key\_usage**() and **X509\_get\_extended\_key\_usage**() return sets of flags corresponding to the certificate extension values.

## SEE ALSO

BASIC\_CONSTRAINTS\_new(3), EXTENDED\_KEY\_USAGE\_new(3), POLICYINFO\_new(3), X509\_check\_ca(3), X509\_check\_purpose(3), X509\_EXTENSION\_new(3), X509\_get\_ext\_d2i(3), X509\_get\_subject\_name(3), X509\_get\_version(3), X509\_new(3)

## HISTORY

**X509\_get\_extension\_flags**, **X509\_get\_key\_usage**, and **X509\_get\_extended\_key\_usage** first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 7.1.