--- name: "libressl-X509_print_ex" section: "3" platform: "linux" package: "libressl" version: "4.4.0-1" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/libressl-X509_print_ex" --- # libressl-X509\_print\_ex(3) pretty-print an X.509 certificate ## NAME **X509\_print\_ex**, **X509\_CERT\_AUX\_print**, **X509\_print\_ex\_fp**, **X509\_print**, **X509\_print\_fp** – pretty-print an X.509 certificate ## SYNOPSIS Crypto Library (libcrypto, -lcrypto) **#include \** *int*\ **X509\_print\_ex**(*BIO \*bio*, *X509 \*x*, *unsigned long nameflags*, *unsigned long skipflags*); *int*\ **X509\_CERT\_AUX\_print**(*BIO \*bio*, *X509\_CERT\_AUX \*aux*, *int indent*); *int*\ **X509\_print\_ex\_fp**(*FILE \*fp*, *X509 \*x*, *unsigned long nameflags*, *unsigned long skipflags*); *int*\ **X509\_print**(*BIO \*bio*, *X509 \*x*); *int*\ **X509\_print\_fp**(*FILE \*fp*, *X509 \*x*); ## DESCRIPTION **X509\_print\_ex**() prints information contained in *x* to *bio* in human-readable form. Printing is aborted as soon as any operation fails, with the exception that failures while attempting to decode or print the public key, the X.509 version 3 extensions, or non-standard auxiliary data are not considered as errors. By default, the following blocks of information are printed in the following order. Each block can be skipped by setting the corresponding bit in *skipflags*, provided in parentheses after each block description. - A pair of lines reading "Certificate:" and "Data:" containing no information. (X509\_FLAG\_NO\_HEADER) - The certificate version number as defined by the standard, followed in parentheses by the value contained in the version field in hexadecimal notation. See X509\_get\_version(3) for details. (X509\_FLAG\_NO\_VERSION) - The serial number of the certificate as returned by X509\_get\_serialNumber(3). If it is not -1 and converting it to *long* succeeds, it is printed in both decimal and hexadecimal format. If it is -1, too wide to fit in *long*, or conversion fails, it is printed byte-by-byte in hexadecimal notation. (X509\_FLAG\_NO\_SERIAL) - The name of the signature algorithm is printed with X509\_signature\_print(3). (X509\_FLAG\_NO\_SIGNAME) - The issuer name returned by X509\_get\_issuer\_name(3) is printed with X509\_NAME\_print\_ex(3). (X509\_FLAG\_NO\_ISSUER) - The validity period from X509\_get\_notBefore(3) to X509\_get\_notAfter(3) is printed using ASN1\_TIME\_print(3). (X509\_FLAG\_NO\_VALIDITY) - The subject name returned from X509\_get\_subject\_name(3) is printed with X509\_NAME\_print\_ex(3). (X509\_FLAG\_NO\_SUBJECT) - The public key algorithm is printed with i2a\_ASN1\_OBJECT(3), and the public key returned from X509\_get\_pubkey(3) with EVP\_PKEY\_print\_public(3). (X509\_FLAG\_NO\_PUBKEY) - If an issuer or a subject unique identifier is present, its hex dump is printed with X509\_signature\_dump(3). (X509\_FLAG\_NO\_IDS) - All X.509 extensions contained in the certificate are printed with X509V3\_extensions\_print(3). (X509\_FLAG\_NO\_EXTENSIONS) - The signature is printed with X509\_signature\_print(3). (X509\_FLAG\_NO\_SIGDUMP) - Non-standard auxiliary data associated with the certificate is printed using the function **X509\_CERT\_AUX\_print**() documented below. (X509\_FLAG\_NO\_AUX) The *nameflags* argument modifies the format for printing X.501 *Name* objects contained in *x*. It is passed through to X509\_NAME\_print\_ex(3). If *nameflags* is X509\_FLAG\_COMPAT, the *indent* argument of X509\_NAME\_print\_ex(3) is set to 16 spaces and the traditional SSLeay format is used. Otherwise, if the only bit set in XN\_FLAG\_SEP\_MASK is XN\_FLAG\_SEP\_MULTILINE, *indent* is set to 12 spaces. Otherwise, *indent* is set to zero. **X509\_CERT\_AUX\_print**() prints information contained in *aux* to *bio* in human-readable form with a left margin of *indent* spaces. If *aux* is NULL, it prints nothing. Information is printed in the following order: - Purposes the certificate is intended to be used for as set with X509\_add1\_trust\_object(3), each printed with OBJ\_obj2txt(3). - Purposes the certificate is explicitly *not* intended to be used for as set with X509\_add1\_reject\_object(3), again each printed with OBJ\_obj2txt(3). - If *aux* contains data set with X509\_alias\_set1(3), the raw bytes are printed in unencoded form. - If *aux* contains data set with X509\_keyid\_set1(3), the bytes are printed in hexadecimal notation with colons in between. **X509\_print\_ex\_fp**() is similar to **X509\_print\_ex**() except that it prints to *fp*. **X509\_print**() and **X509\_print\_fp**() are wrapper functions setting the *nameflags* to XN\_FLAG\_COMPAT and the *skipflags* to X509\_FLAG\_COMPAT. ## RETURN VALUES **X509\_print\_ex**(), **X509\_print\_ex\_fp**(), **X509\_print**(), and **X509\_print\_fp**() return 1 if all requested information was successfully printed, even if failures occurred while attempting to decode or print the public key or X.509 version 3 extensions, or 0 if any other operation failed. **X509\_CERT\_AUX\_print**() always returns 1 and silently ignores write errors. ## SEE ALSO BIO\_new(3), X509\_CERT\_AUX\_new(3), X509\_CRL\_print(3), X509\_new(3), X509\_REQ\_print\_ex(3) ## HISTORY **X509\_print**() first appeared in SSLeay 0.5.1 and was changed to print to a *BIO* in SSLeay 0.6.0. **X509\_print\_fp**() first appeared in SSLeay 0.6.0. Both functions have been available since OpenBSD 2.4. **X509\_CERT\_AUX\_print**() first appeared in OpenSSL 0.9.5 and has been available since OpenBSD 2.7. **X509\_print\_ex**() and **X509\_print\_ex\_fp**() first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2. ## BUGS If arbitrary data was stored into *x* using X509\_alias\_set1(3), these functions may print binary data and even NUL bytes.