---
name: "libressl-X509_sign"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509_sign"
---

# libressl-X509\_sign(3)

sign or verify certificate, certificate request, or CRL signature

## NAME

**X509\_sign**, **X509\_sign\_ctx**, **X509\_verify**, **X509\_REQ\_sign**, **X509\_REQ\_sign\_ctx**, **X509\_REQ\_verify**, **X509\_CRL\_sign**, **X509\_CRL\_sign\_ctx**, **X509\_CRL\_verify** – sign or verify certificate, certificate request, or CRL signature

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*int*\

**X509\_sign**(*X509 \*x*, *EVP\_PKEY \*pkey*, *const EVP\_MD \*md*);

*int*\

**X509\_sign\_ctx**(*X509 \*x*, *EVP\_MD\_CTX \*ctx*);

*int*\

**X509\_verify**(*X509 \*x*, *EVP\_PKEY \*pkey*);

*int*\

**X509\_REQ\_sign**(*X509\_REQ \*x*, *EVP\_PKEY \*pkey*, *const EVP\_MD \*md*);

*int*\

**X509\_REQ\_sign\_ctx**(*X509\_REQ \*x*, *EVP\_MD\_CTX \*ctx*);

*int*\

**X509\_REQ\_verify**(*X509\_REQ \*x*, *EVP\_PKEY \*pkey*);

*int*\

**X509\_CRL\_sign**(*X509\_CRL \*x*, *EVP\_PKEY \*pkey*, *const EVP\_MD \*md*);

*int*\

**X509\_CRL\_sign\_ctx**(*X509\_CRL \*x*, *EVP\_MD\_CTX \*ctx*);

*int*\

**X509\_CRL\_verify**(*X509\_CRL \*x*, *EVP\_PKEY \*pkey*);

## DESCRIPTION

**X509\_sign**() signs the certificate *x* using the private key *pkey* and the message digest *md* and sets the signature in *x*. **X509\_sign\_ctx**() also signs the certificate *x* but uses the parameters contained in digest context *ctx*.

**X509\_verify**() verifies the signature of certificate *x* using the public key *pkey*. Only the signature is checked: no other checks (such as certificate chain validity) are performed.

**X509\_REQ\_sign**(), **X509\_REQ\_sign\_ctx**(), **X509\_REQ\_verify**(), **X509\_CRL\_sign**(), **X509\_CRL\_sign\_ctx**(), and **X509\_CRL\_verify**() sign and verify certificate requests and CRLs, respectively.

**X509\_sign\_ctx**() is used where the default parameters for the corresponding public key and digest are not suitable. It can be used to sign keys using RSA-PSS for example.

## RETURN VALUES

**X509\_sign**(), **X509\_sign\_ctx**(), **X509\_REQ\_sign**(), **X509\_REQ\_sign\_ctx**(), **X509\_CRL\_sign**(), and **X509\_CRL\_sign\_ctx**() return the size of the signature in bytes for success or 0 for failure.

**X509\_verify**(), **X509\_REQ\_verify**(), and **X509\_CRL\_verify**() return 1 if the signature is valid or 0 if the signature check fails. If the signature could not be checked at all because it was invalid or some other error occurred, then -1 is returned.

In some cases of failure, the reason can be determined with ERR\_get\_error(3).

## SEE ALSO

d2i\_X509(3), EVP\_DigestInit(3), X509\_CRL\_get0\_by\_serial(3), X509\_CRL\_new(3), X509\_get\_pubkey(3), X509\_get\_subject\_name(3), X509\_get\_version(3), X509\_NAME\_add\_entry\_by\_txt(3), X509\_NAME\_ENTRY\_get\_object(3), X509\_NAME\_get\_index\_by\_NID(3), X509\_NAME\_print\_ex(3), X509\_new(3), X509\_REQ\_new(3), X509\_verify\_cert(3), X509V3\_get\_d2i(3)

## HISTORY

**X509\_verify**() appeared in SSLeay 0.4 or earlier. **X509\_sign**() and **X509\_REQ\_sign**() first appeared in SSLeay 0.4.4. **X509\_REQ\_verify**() and **X509\_CRL\_verify**() first appeared in SSLeay 0.4.5b. **X509\_CRL\_sign**() first appeared in SSLeay 0.5.1. These functions have been available since OpenBSD 2.4.

**X509\_sign\_ctx**(), **X509\_REQ\_sign\_ctx**(), and **X509\_CRL\_sign\_ctx**() first appeared in OpenSSL 1.0.1 and have been available since OpenBSD 5.3.