---
name: "libressl-X509v3_get_ext_by_NID"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-X509v3_get_ext_by_NID"
---

# libressl-X509v3\_get\_ext\_by\_NID(3)

extension stack utility functions

## NAME

**X509v3\_get\_ext\_count**, **X509v3\_get\_ext**, **X509v3\_get\_ext\_by\_NID**, **X509v3\_get\_ext\_by\_OBJ**, **X509v3\_get\_ext\_by\_critical**, **X509v3\_delete\_ext**, **X509v3\_add\_ext**, **X509\_get\_ext\_count**, **X509\_get\_ext**, **X509\_get\_ext\_by\_NID**, **X509\_get\_ext\_by\_OBJ**, **X509\_get\_ext\_by\_critical**, **X509\_delete\_ext**, **X509\_add\_ext**, **X509\_CRL\_get\_ext\_count**, **X509\_CRL\_get\_ext**, **X509\_CRL\_get\_ext\_by\_NID**, **X509\_CRL\_get\_ext\_by\_OBJ**, **X509\_CRL\_get\_ext\_by\_critical**, **X509\_CRL\_delete\_ext**, **X509\_CRL\_add\_ext**, **X509\_REVOKED\_get\_ext\_count**, **X509\_REVOKED\_get\_ext**, **X509\_REVOKED\_get\_ext\_by\_NID**, **X509\_REVOKED\_get\_ext\_by\_OBJ**, **X509\_REVOKED\_get\_ext\_by\_critical**, **X509\_REVOKED\_delete\_ext**, **X509\_REVOKED\_add\_ext** – extension stack utility functions

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*int*\

**X509v3\_get\_ext\_count**(*const STACK\_OF(X509\_EXTENSION) \*x*);

*X509\_EXTENSION* *\**\

**X509v3\_get\_ext**(*const STACK\_OF(X509\_EXTENSION) \*x*, *int loc*);

*int*\

**X509v3\_get\_ext\_by\_NID**(*const STACK\_OF(X509\_EXTENSION) \*x*, *int nid*, *int lastpos*);

*int*\

**X509v3\_get\_ext\_by\_OBJ**(*const STACK\_OF(X509\_EXTENSION) \*x*, *const ASN1\_OBJECT \*obj*, *int lastpos*);

*int*\

**X509v3\_get\_ext\_by\_critical**(*const STACK\_OF(X509\_EXTENSION) \*x*, *int crit*, *int lastpos*);

*X509\_EXTENSION* *\**\

**X509v3\_delete\_ext**(*STACK\_OF(X509\_EXTENSION) \*x*, *int loc*);

*STACK\_OF(X509\_EXTENSION)* *\**\

**X509v3\_add\_ext**(*STACK\_OF(X509\_EXTENSION) \*\*x*, *X509\_EXTENSION \*ex*, *int loc*);

*int*\

**X509\_get\_ext\_count**(*const X509 \*x*);

*X509\_EXTENSION* *\**\

**X509\_get\_ext**(*const X509 \*x*, *int loc*);

*int*\

**X509\_get\_ext\_by\_NID**(*const X509 \*x*, *int nid*, *int lastpos*);

*int*\

**X509\_get\_ext\_by\_OBJ**(*const X509 \*x*, *const ASN1\_OBJECT \*obj*, *int lastpos*);

*int*\

**X509\_get\_ext\_by\_critical**(*const X509 \*x*, *int crit*, *int lastpos*);

*X509\_EXTENSION* *\**\

**X509\_delete\_ext**(*X509 \*x*, *int loc*);

*int*\

**X509\_add\_ext**(*X509 \*x*, *X509\_EXTENSION \*ex*, *int loc*);

*int*\

**X509\_CRL\_get\_ext\_count**(*const X509\_CRL \*x*);

*X509\_EXTENSION* *\**\

**X509\_CRL\_get\_ext**(*const X509\_CRL \*x*, *int loc*);

*int*\

**X509\_CRL\_get\_ext\_by\_NID**(*const X509\_CRL \*x*, *int nid*, *int lastpos*);

*int*\

**X509\_CRL\_get\_ext\_by\_OBJ**(*const X509\_CRL \*x*, *const ASN1\_OBJECT \*obj*, *int lastpos*);

*int*\

**X509\_CRL\_get\_ext\_by\_critical**(*const X509\_CRL \*x*, *int crit*, *int lastpos*);

*X509\_EXTENSION* *\**\

**X509\_CRL\_delete\_ext**(*X509\_CRL \*x*, *int loc*);

*int*\

**X509\_CRL\_add\_ext**(*X509\_CRL \*x*, *X509\_EXTENSION \*ex*, *int loc*);

*int*\

**X509\_REVOKED\_get\_ext\_count**(*const X509\_REVOKED \*x*);

*X509\_EXTENSION* *\**\

**X509\_REVOKED\_get\_ext**(*const X509\_REVOKED \*x*, *int loc*);

*int*\

**X509\_REVOKED\_get\_ext\_by\_NID**(*const X509\_REVOKED \*x*, *int nid*, *int lastpos*);

*int*\

**X509\_REVOKED\_get\_ext\_by\_OBJ**(*const X509\_REVOKED \*x*, *const ASN1\_OBJECT \*obj*, *int lastpos*);

*int*\

**X509\_REVOKED\_get\_ext\_by\_critical**(*const X509\_REVOKED \*x*, *int crit*, *int lastpos*);

*X509\_EXTENSION* *\**\

**X509\_REVOKED\_delete\_ext**(*X509\_REVOKED \*x*, *int loc*);

*int*\

**X509\_REVOKED\_add\_ext**(*X509\_REVOKED \*x*, *X509\_EXTENSION \*ex*, *int loc*);

## DESCRIPTION

**X509v3\_get\_ext\_count**() retrieves the number of extensions in *x*.

**X509v3\_get\_ext**() retrieves extension *loc* from *x*. The index *loc* can take any value from 0 to **X509\_get\_ext\_count**(*x*, *No*, *-*, *1*). The returned extension is an internal pointer which must not be freed up by the application.

**X509v3\_get\_ext\_by\_NID**() and **X509v3\_get\_ext\_by\_OBJ**() look for an extension with *nid* or *obj* from extension stack *x*. The search starts from the extension after *lastpos* or from the beginning if *lastpos* is -1. If the extension is found, its index is returned; otherwise, a negative value is returned.

**X509v3\_get\_ext\_by\_critical**() is similar to **X509v3\_get\_ext\_by\_NID**() except that it looks for an extension of criticality *crit*. A zero value for *crit* looks for a non-critical extension; a non-zero value looks for a critical extension.

**X509v3\_delete\_ext**() deletes the extension with index *loc* from *x*. The deleted extension is returned and must be freed by the caller. If *loc* is an invalid index value, NULL is returned.

**X509v3\_add\_ext**() adds the extension *ex* to the stack \**x* at position *loc*. If *loc* is -1, the new extension is added to the end. If \**x* is NULL, a new stack will be allocated. The passed extension *ex* is duplicated internally so it must be freed after use.

**X509\_get\_ext\_count**(), **X509\_get\_ext**(), **X509\_get\_ext\_by\_NID**(), **X509\_get\_ext\_by\_OBJ**(), **X509\_get\_ext\_by\_critical**(), **X509\_delete\_ext**(), and **X509\_add\_ext**() operate on the extensions of certificate *x*. They are otherwise identical to the X509v3 functions.

**X509\_CRL\_get\_ext\_count**(), **X509\_CRL\_get\_ext**(), **X509\_CRL\_get\_ext\_by\_NID**(), **X509\_CRL\_get\_ext\_by\_OBJ**(), **X509\_CRL\_get\_ext\_by\_critical**(), **X509\_CRL\_delete\_ext**(), and **X509\_CRL\_add\_ext**() operate on the extensions of the CRL *x*. They are otherwise identical to the X509v3 functions.

**X509\_REVOKED\_get\_ext\_count**(), **X509\_REVOKED\_get\_ext**(), **X509\_REVOKED\_get\_ext\_by\_NID**(), **X509\_REVOKED\_get\_ext\_by\_OBJ**(), **X509\_REVOKED\_get\_ext\_by\_critical**(), **X509\_REVOKED\_delete\_ext**(), and **X509\_REVOKED\_add\_ext**() operate on the extensions of the CRL entry *x*. They are otherwise identical to the X509v3 functions.

These functions are used to examine stacks of extensions directly. Many applications will want to parse or encode and add an extension: they should use the extension encode and decode functions instead such as X509\_get\_ext\_d2i(3).

Extension indices start from zero, so a zero index return value is not an error. These search functions start from the extension *after* the *lastpos* parameter, so it should initially be set to -1. If it is set to 0, the initial extension will not be checked.

## RETURN VALUES

**X509v3\_get\_ext\_count**() returns the extension count.

**X509v3\_get\_ext**(), **X509v3\_delete\_ext**(), and **X509\_delete\_ext**() return an *X509\_EXTENSION* pointer or NULL if an error occurs.

**X509v3\_get\_ext\_by\_NID**(), **X509v3\_get\_ext\_by\_OBJ**(), and **X509v3\_get\_ext\_by\_critical**() return the extension index or -1 if an error occurs. In addition, **X509v3\_get\_ext\_by\_NID**() returns -2 if OBJ\_nid2obj(3) fails on the requested *nid*.

**X509v3\_add\_ext**() returns a stack of extensions or NULL on error.

**X509\_add\_ext**() returns 1 on success or 0 on error.

## SEE ALSO

OBJ\_nid2obj(3), X509\_CRL\_new(3), X509\_EXTENSION\_new(3), X509\_new(3), X509\_REVOKED\_new(3), X509V3\_EXT\_print(3), X509V3\_extensions\_print(3), X509V3\_get\_d2i(3)

## HISTORY

These functions first appeared in SSLeay 0.8.0 and have been available since OpenBSD 2.4.