---
name: "libressl-X509_new"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_new"
---

# libressl-X509\_new(3)

X.509 certificate object

## NAME

**X509\_new**, **X509\_dup**, **X509\_REQ\_to\_X509**, **X509\_free**, **X509\_up\_ref**, **X509\_chain\_up\_ref** – X.509 certificate object

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*X509* *\**\

**X509\_new**(*void*);

*X509* *\**\

**X509\_dup**(*X509 \*a*);

*X509* *\**\

**X509\_REQ\_to\_X509**(*X509\_REQ \*req*, *int days*, *EVP\_PKEY \*pkey*);

*void*\

**X509\_free**(*X509 \*a*);

*int*\

**X509\_up\_ref**(*X509 \*a*);

*STACK\_OF(X509)* *\**\

**X509\_chain\_up\_ref**(*STACK\_OF(X509) \*chain*);

## DESCRIPTION

**X509\_new**() allocates and initializes an empty *X509* object with reference count 1. It represents an ASN.1 *Certificate* structure defined in RFC 5280 section 4.1. It can hold a public key together with information about the person, organization, device, or function the associated private key belongs to.

**X509\_dup**() creates a deep copy of *a* using ASN1\_item\_dup(3), setting the reference count of the copy to 1.

**X509\_REQ\_to\_X509**() allocates a new certificate object, copies the public key from *req* into it, copies the subject name of *req* to both the subject and issuer names of the new certificate, sets the *notBefore* field to the current time and the *notAfter* field to the given number of *days* in the future, and signs the new certificate with X509\_sign(3) using *pkey* and the MD5 algorithm. If *req* contains at least one attribute, the version of the new certificate is set to 2.

**X509\_free**() decrements the reference count of the *X509* structure *a* and frees it up if the reference count reaches 0. If *a* is a NULL pointer, no action occurs.

**X509\_up\_ref**() increments the reference count of *a* by 1. This function is useful if a certificate structure is being used by several different operations each of which will free it up after use: this avoids the need to duplicate the entire certificate structure.

**X509\_chain\_up\_ref**() performs a shallow copy of the given *chain* using **sk\_X509\_dup**() and increments the reference count of each contained certificate by 1. Its purpose is similar to **X509\_up\_ref**(): The returned chain persists after the original is freed.

## RETURN VALUES

**X509\_new**(), **X509\_dup**(), and **X509\_REQ\_to\_X509**() return a pointer to the newly allocated object or NULL if an error occurs; an error code can be obtained by ERR\_get\_error(3).

**X509\_up\_ref**() returns 1 for success or 0 for failure.

**X509\_chain\_up\_ref**() returns the copy of the *chain* or NULL if an error occurs.

## SEE ALSO

ASIdentifiers\_new(3), ASRange\_new(3), AUTHORITY\_KEYID\_new(3), BASIC\_CONSTRAINTS\_new(3), [crypto(3)](/crypto/3.md), d2i\_X509(3), IPAddressRange\_new(3), PKCS8\_PRIV\_KEY\_INFO\_new(3), X509\_ALGOR\_new(3), X509\_ATTRIBUTE\_new(3), X509\_check\_ca(3), X509\_check\_host(3), X509\_check\_issued(3), X509\_check\_private\_key(3), X509\_check\_purpose(3), X509\_CINF\_new(3), X509\_cmp(3), X509\_CRL\_new(3), X509\_digest(3), X509\_EXTENSION\_new(3), X509\_find\_by\_subject(3), X509\_get0\_notBefore(3), X509\_get0\_signature(3), X509\_get1\_email(3), X509\_get\_ex\_new\_index(3), X509\_get\_extension\_flags(3), X509\_get\_pubkey(3), X509\_get\_pubkey\_parameters(3), X509\_get\_serialNumber(3), X509\_get\_subject\_name(3), X509\_get\_version(3), X509\_INFO\_new(3), X509\_load\_cert\_file(3), X509\_LOOKUP\_hash\_dir(3), X509\_LOOKUP\_new(3), X509\_NAME\_new(3), X509\_OBJECT\_new(3), X509\_print\_ex(3), X509\_PUBKEY\_new(3), X509\_PURPOSE\_set(3), X509\_REQ\_new(3), X509\_SIG\_new(3), X509\_sign(3), X509\_STORE\_CTX\_new(3), X509\_STORE\_get\_by\_subject(3), X509\_STORE\_new(3), X509v3\_addr\_add\_inherit(3), X509v3\_addr\_get\_range(3), X509v3\_addr\_inherits(3), X509v3\_addr\_subset(3), X509v3\_addr\_validate\_path(3), X509v3\_asid\_add\_id\_or\_range(3)

## STANDARDS

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile

## HISTORY

**X509\_new**() and **X509\_free**() appeared in SSLeay 0.4 or earlier, **X509\_dup**() in SSLeay 0.4.4, and **X509\_REQ\_to\_X509**() in SSLeay 0.6.0 . These functions have been available since OpenBSD 2.4.

**X509\_up\_ref**() first appeared in OpenSSL 1.1.0 and has been available since OpenBSD 6.1.

**X509\_chain\_up\_ref**() first appeared in OpenSSL 1.0.2 and has been available since OpenBSD 6.3.

## BUGS

The X.509 public key infrastructure and its data types contain too many design bugs to list them. For lots of examples, see the classic *X.509 Style Guide:* **https://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt** that Peter Gutmann published in 2000.