---
name: "libressl-X509_keyid_set1"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_keyid_set1"
---

# libressl-X509\_keyid\_set1(3)

auxiliary certificate data for PKCS#12

## NAME

**X509\_keyid\_set1**, **X509\_keyid\_get0**, **X509\_alias\_set1**, **X509\_alias\_get0** – auxiliary certificate data for PKCS#12

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*int*\

**X509\_keyid\_set1**(*X509 \*x*, *const unsigned char \*data*, *int len*);

*unsigned* *char* *\**\

**X509\_keyid\_get0**(*X509 \*x*, *int \*plen*);

*int*\

**X509\_alias\_set1**(*X509 \*x*, *const unsigned char \*data*, *int len*);

*unsigned* *char* *\**\

**X509\_alias\_get0**(*X509 \*x*, *int \*plen*);

## DESCRIPTION

These functions store non-standard auxiliary data in *x* and retrieve it.

The *len* bytes of *data* stored using **X509\_keyid\_set1**() will be written to the **localKeyID** attribute of the PKCS#12 structure if PKCS12\_create(3) is later called on *x*, and the *data* stored using **X509\_alias\_set1**() will be written to the **friendlyName** attribute. If *data* points to a NUL-terminated string, -1 can be passed as the *len* argument to let *len* be calculated internally using [strlen(3)](/strlen/3.md). If a NULL pointer is passed as the *data* argument, the respective auxiliary data stored in *x*, if any, is removed from *x* and freed.

Conversely, PKCS12\_parse(3) retrieves these attributes from a PKCS#12 structure such that they can subsequently be accessed with **X509\_keyid\_get0**() and **X509\_alias\_get0**(). Unless NULL is passed for the *plen* argument, these functions store the size of the returned buffer in bytes in \**plen*. After the call, the returned buffer is not necessarily NUL-terminated, but it may contain internal NUL bytes.

API design is very incomplete; given the complexity of PKCS#12, that's probably an asset rather than a defect. The PKCS#12 standard defines many attributes that cannot be stored in *X509* objects.

To associate certificates with alternative names and key identifiers, X.509 certificate extensions are more commonly used than PKCS#12 attributes, for example using X509\_EXTENSION\_create\_by\_NID(3) with NID\_subject\_alt\_name or NID\_subject\_key\_identifier.

## RETURN VALUES

**X509\_keyid\_set1**() and **X509\_alias\_set1**() return 1 if *data* is NULL or if the input *data* was successfully copied into *x*, or 0 if *data* is not NULL but could not be copied because *x* is NULL or memory allocation failed.

**X509\_keyid\_get0**() and **X509\_alias\_get0**() return an internal pointer to an array of bytes or NULL if *x* does not contain auxiliary data of the requested kind.

## SEE ALSO

ASN1\_STRING\_set(3), X509\_CERT\_AUX\_new(3), X509\_EXTENSION\_new(3), X509\_new(3), X509V3\_get\_d2i(3)

## HISTORY

**X509\_alias\_set1**() and **X509\_alias\_get0**() first appeared in OpenSSL 0.9.5 and have been available since OpenBSD 2.7.

**X509\_keyid\_set1**() first appeared in OpenSSL 0.9.6 and has been available since OpenBSD 2.9.

**X509\_keyid\_get0**() first appeared in OpenSSL 0.9.8 and has been available since OpenBSD 4.5.