---
name: "libressl-d2i_X509"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-d2i_X509"
---

# libressl-d2i\_X509(3)

decode and encode X.509 certificates

## NAME

**d2i\_X509**, **i2d\_X509**, **d2i\_X509\_bio**, **d2i\_X509\_fp**, **i2d\_X509\_bio**, **i2d\_X509\_fp**, **d2i\_X509\_AUX**, **i2d\_X509\_AUX**, **d2i\_X509\_CERT\_AUX**, **i2d\_X509\_CERT\_AUX**, **d2i\_X509\_CINF**, **i2d\_X509\_CINF**, **d2i\_X509\_VAL**, **i2d\_X509\_VAL**, **i2d\_re\_X509\_tbs**, **i2d\_re\_X509\_CRL\_tbs**, **i2d\_re\_X509\_REQ\_tbs** – decode and encode X.509 certificates

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*X509* *\**\

**d2i\_X509**(*X509 \*\*val\_out*, *const unsigned char \*\*der\_in*, *long length*);

*int*\

**i2d\_X509**(*X509 \*val\_in*, *unsigned char \*\*der\_out*);

*X509* *\**\

**d2i\_X509\_bio**(*BIO \*in\_bio*, *X509 \*\*val\_out*);

*X509* *\**\

**d2i\_X509\_fp**(*FILE \*in\_fp*, *X509 \*\*val\_out*);

*int*\

**i2d\_X509\_bio**(*BIO \*out\_bio*, *X509 \*val\_in*);

*int*\

**i2d\_X509\_fp**(*FILE \*out\_fp*, *X509 \*val\_in*);

*X509* *\**\

**d2i\_X509\_AUX**(*X509 \*\*val\_out*, *const unsigned char \*\*der\_in*, *long length*);

*int*\

**i2d\_X509\_AUX**(*X509 \*val\_in*, *unsigned char \*\*der\_out*);

*X509\_CERT\_AUX* *\**\

**d2i\_X509\_CERT\_AUX**(*X509\_CERT\_AUX \*\*val\_out*, *const unsigned char \*\*der\_in*, *long length*);

*int*\

**i2d\_X509\_CERT\_AUX**(*X509\_CERT\_AUX \*val\_in*, *unsigned char \*\*der\_out*);

*X509\_CINF* *\**\

**d2i\_X509\_CINF**(*X509\_CINF \*\*val\_out*, *const unsigned char \*\*der\_in*, *long length*);

*int*\

**i2d\_X509\_CINF**(*X509\_CINF \*val\_in*, *unsigned char \*\*der\_out*);

*X509\_VAL* *\**\

**d2i\_X509\_VAL**(*X509\_VAL \*\*val\_out*, *const unsigned char \*\*der\_in*, *long length*);

*int*\

**i2d\_X509\_VAL**(*X509\_VAL \*val\_in*, *unsigned char \*\*der\_out*);

*int*\

**i2d\_re\_X509\_tbs**(*X509 \*x*, *unsigned char \*\*out*);

*int*\

**i2d\_re\_X509\_CRL\_tbs**(*X509\_CRL \*crl*, *unsigned char \*\*pp*);

*int*\

**i2d\_re\_X509\_REQ\_tbs**(*X509\_REQ \*req*, *unsigned char \*\*pp*);

## DESCRIPTION

These functions decode and encode X.509 certificates and some of their substructures. For details about the semantics, examples, caveats, and bugs, see ASN1\_item\_d2i(3).

**d2i\_X509**() and **i2d\_X509**() decode and encode an ASN.1 *Certificate* structure defined in RFC 5280 section 4.1.

**d2i\_X509\_bio**(), **d2i\_X509\_fp**(), **i2d\_X509\_bio**(), and **i2d\_X509\_fp**() are similar except that they decode or encode using a *BIO* or *FILE* pointer.

**d2i\_X509\_AUX**() is similar to **d2i\_X509**(), but the input is expected to consist of an X.509 certificate followed by auxiliary trust information. This is used by the PEM routines to read TRUSTED CERTIFICATE objects. This function should not be called on untrusted input.

**i2d\_X509\_AUX**() is similar to **i2d\_X509**(), but the encoded output contains both the certificate and any auxiliary trust information. This is used by the PEM routines to write TRUSTED CERTIFICATE objects. Note that this is a non-standard OpenSSL-specific data format.

**d2i\_X509\_CERT\_AUX**() and **i2d\_X509\_CERT\_AUX**() decode and encode optional non-standard auxiliary data appended to a certificate, for example friendly alias names and trust data.

**d2i\_X509\_CINF**() and **i2d\_X509\_CINF**() decode and encode an ASN.1 *TBSCertificate* structure defined in RFC 5280 section 4.1.

**d2i\_X509\_VAL**() and **i2d\_X509\_VAL**() decode and encode an ASN.1 *Validity* structure defined in RFC 5280 section 4.1.

**i2d\_re\_X509\_tbs**() is similar to **i2d\_X509**(), except it encodes only the TBSCertificate portion of the certificate. **i2d\_re\_X509\_CRL\_tbs**() and **i2d\_re\_X509\_REQ\_tbs**() are analogous for CRL and certificate request, respectively. The "re" in **i2d\_re\_X509\_tbs**() stands for "re-encode", and ensures that a fresh encoding is generated in case the object has been modified after creation.

The encoding of the TBSCertificate portion of a certificate is cached in the *X509* structure internally to improve encoding performance and to ensure certificate signatures are verified correctly in some certificates with broken (non-DER) encodings.

If, after modification, the *X509* object is re-signed with X509\_sign(3), the encoding is automatically renewed. Otherwise, the encoding of the TBSCertificate portion of the *X509* can be manually renewed by calling **i2d\_re\_X509\_tbs**().

## RETURN VALUES

**d2i\_X509**(), **d2i\_X509\_bio**(), **d2i\_X509\_fp**(), and **d2i\_X509\_AUX**() return a valid *X509* structure or NULL if an error occurs.

**d2i\_X509\_CERT\_AUX**(), **d2i\_X509\_CINF**(), and **d2i\_X509\_VAL**() return an *X509\_CERT\_AUX*, *X509\_CINF*, or *X509\_VAL* object, respectively, or NULL if an error occurs.

**i2d\_X509**(), **i2d\_X509\_AUX**(), **i2d\_X509\_CERT\_AUX**(), **i2d\_X509\_CINF**(), and **i2d\_X509\_VAL**() return the number of bytes successfully encoded or a negative value if an error occurs.

**i2d\_X509\_bio**() and **i2d\_X509\_fp**() return 1 for success or 0 if an error occurs.

**i2d\_re\_X509\_tbs**(), **i2d\_re\_X509\_CRL\_tbs**(), and **i2d\_re\_X509\_REQ\_tbs**() return the number of bytes successfully encoded or 0 if an error occurs.

For all functions, the error code can be obtained by ERR\_get\_error(3).

## SEE ALSO

ASN1\_item\_d2i(3), X509\_CINF\_new(3), X509\_new(3)

## STANDARDS

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile

## HISTORY

**d2i\_X509**(), **i2d\_X509**(), **d2i\_X509\_fp**(), **i2d\_X509\_fp**(), **d2i\_X509\_CINF**(), **i2d\_X509\_CINF**(), **d2i\_X509\_VAL**(), and **i2d\_X509\_VAL**() first appeared in SSLeay 0.5.1. **d2i\_X509\_bio**() and **i2d\_X509\_bio**() first appeared in SSLeay 0.6.0. These functions have been available since OpenBSD 2.4.

**d2i\_X509\_AUX**(), **i2d\_X509\_AUX**(), **d2i\_X509\_CERT\_AUX**(), and **i2d\_X509\_CERT\_AUX**() first appeared in OpenSSL 0.9.5 and have been available since OpenBSD 2.7.

**i2d\_re\_X509\_tbs**(), **i2d\_re\_X509\_CRL\_tbs**(), and **i2d\_re\_X509\_REQ\_tbs**() first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 7.1.