---
name: "libressl-X509_get_pubkey"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_get_pubkey"
---

# libressl-X509\_get\_pubkey(3)

get or set certificate or certificate request public key

## NAME

**X509\_get\_pubkey**, **X509\_get0\_pubkey**, **X509\_set\_pubkey**, **X509\_get\_X509\_PUBKEY**, **X509\_get0\_pubkey\_bitstr**, **X509\_REQ\_get\_pubkey**, **X509\_REQ\_get0\_pubkey**, **X509\_REQ\_set\_pubkey**, **X509\_extract\_key**, **X509\_REQ\_extract\_key** – get or set certificate or certificate request public key

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*EVP\_PKEY* *\**\

**X509\_get\_pubkey**(*X509 \*x*);

*EVP\_PKEY* *\**\

**X509\_get0\_pubkey**(*const X509 \*x*);

*int*\

**X509\_set\_pubkey**(*X509 \*x*, *EVP\_PKEY \*pkey*);

*X509\_PUBKEY* *\**\

**X509\_get\_X509\_PUBKEY**(*const X509 \*x*);

*ASN1\_BIT\_STRING* *\**\

**X509\_get0\_pubkey\_bitstr**(*const X509 \*x*);

*EVP\_PKEY* *\**\

**X509\_REQ\_get\_pubkey**(*X509\_REQ \*req*);

*EVP\_PKEY* *\**\

**X509\_REQ\_get0\_pubkey**(*X509\_REQ \*req*);

*int*\

**X509\_REQ\_set\_pubkey**(*X509\_REQ \*x*, *EVP\_PKEY \*pkey*);

*EVP\_PKEY* *\**\

**X509\_extract\_key**(*X509 \*x*);

*EVP\_PKEY* *\**\

**X509\_REQ\_extract\_key**(*X509\_REQ \*req*);

## DESCRIPTION

**X509\_get\_pubkey**() attempts to decode the public key for certificate *x*. If successful, it returns the public key as an *EVP\_PKEY* pointer with its reference count incremented: this means the returned key must be freed up after use. **X509\_get0\_pubkey**() is similar except that it does not increment the reference count of the returned *EVP\_PKEY*, so it must not be freed up after use.

**X509\_get\_X509\_PUBKEY**() returns an internal pointer to the *SubjectPublicKeyInfo* structure contained in *x*. The returned value must not be freed up after use.

**X509\_get0\_pubkey\_bitstr**() returns an internal pointer to just the public key contained in this *SubjectPublicKeyInfo* structure, without the information about the algorithm used.

**X509\_set\_pubkey**() attempts to set the public key for certificate *x* to *pkey*. The key *pkey* should be freed up after use.

**X509\_REQ\_get\_pubkey**(), **X509\_REQ\_get0\_pubkey**(), and **X509\_REQ\_set\_pubkey**() are similar but operate on certificate request *req*.

The first time a public key is decoded, the *EVP\_PKEY* structure is cached in the certificate or certificate request itself. Subsequent calls return the cached structure with its reference count incremented to improve performance.

**X509\_extract\_key**() and **X509\_REQ\_extract\_key**() are deprecated aliases for **X509\_get\_pubkey**() and **X509\_REQ\_get\_pubkey**(), respectively, implemented as macros.

## RETURN VALUES

**X509\_get\_pubkey**(), **X509\_get0\_pubkey**(), **X509\_get\_X509\_PUBKEY**(), **X509\_get0\_pubkey\_bitstr**(), **X509\_REQ\_get\_pubkey**(), **X509\_REQ\_get0\_pubkey**(), **X509\_extract\_key**(), and **X509\_REQ\_extract\_key**() return a public key or NULL if an error occurred.

**X509\_set\_pubkey**() and **X509\_REQ\_set\_pubkey**() return 1 for success or 0 for failure.

In some cases of failure of **X509\_get0\_pubkey**(), **X509\_set\_pubkey**(), **X509\_REQ\_get\_pubkey**(), **X509\_REQ\_get0\_pubkey**(), and **X509\_REQ\_set\_pubkey**(), the reason can be determined with ERR\_get\_error(3).

## ERRORS

**X509\_get\_pubkey**(), **X509\_get0\_pubkey**(), **X509\_REQ\_get\_pubkey**(), **X509\_extract\_key**(), and **X509\_REQ\_extract\_key**() provide diagnostics as documented for X509\_PUBKEY\_get(3). If *x* or *req* is NULL or contains no certificate information, they fail without pushing an error onto the stack.

**X509\_get\_X509\_PUBKEY**() provides no diagnostics and crashes by accessing a NULL pointer if *x* is NULL or contains no certificate information,

**X509\_get0\_pubkey\_bitstr**() provides no diagnostics and fails without pushing an error onto the stack if *x* is NULL, but it crashes by accessing a NULL pointer if *x* contains no certificate information.

## SEE ALSO

d2i\_X509(3), X509\_CRL\_get0\_by\_serial(3), X509\_NAME\_add\_entry\_by\_txt(3), X509\_NAME\_ENTRY\_get\_object(3), X509\_NAME\_get\_index\_by\_NID(3), X509\_NAME\_print\_ex(3), X509\_new(3), X509\_PUBKEY\_new(3), X509\_REQ\_new(3), X509\_sign(3), X509\_verify\_cert(3), X509V3\_get\_d2i(3)

## STANDARDS

RFC 5280, Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, section 4.1 Basic Certificate Fields

RFC 2986: PKCS #10: Certification Request Syntax Specification, section 4.1 CertificationRequestInfo

## HISTORY

**X509\_extract\_key**() and **X509\_REQ\_extract\_key**() first appeared in SSLeay 0.5.1 but returned a pointer to an *RSA* object before SSLeay 0.6.0. **X509\_get\_pubkey**(), **X509\_set\_pubkey**(), **X509\_REQ\_get\_pubkey**(), and **X509\_REQ\_set\_pubkey**() first appeared in SSLeay 0.6.5. **X509\_get\_X509\_PUBKEY**() first appeared in SSLeay 0.8.0. These functions have been available since OpenBSD 2.4.

**X509\_get0\_pubkey\_bitstr**() first appeared in OpenSSL 0.9.7 and has been available since OpenBSD 3.4.

**X509\_get0\_pubkey**() first appeared in OpenSSL 1.1.0 and has been available since OpenBSD 6.3. **X509\_REQ\_get0\_pubkey**() first appeared in OpenSSL 1.1.0 and has been available since OpenBSD 7.1.