---
name: "libressl-x509_verify"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-x509_verify"
---

# libressl-x509\_verify(3)

discover and verify X.509 certificate chains

## NAME

**x509\_verify**, **x509\_verify\_ctx\_new**, **x509\_verify\_ctx\_free**, **x509\_verify\_ctx\_set\_max\_depth**, **x509\_verify\_ctx\_set\_max\_signatures**, **x509\_verify\_ctx\_set\_max\_chains**, **x509\_verify\_ctx\_set\_purpose**, **x509\_verify\_ctx\_set\_intermediates**, **x509\_verify\_ctx\_error\_string**, **x509\_verify\_ctx\_error\_depth**, **x509\_verify\_ctx\_chain** – discover and verify X.509 certificate chains

## SYNOPSIS

**#include \<openssl/x509\_verify.h\>**

*size\_t*\

**x509\_verify**(*X509\_VERIFY\_CTX \*ctx*, *X509 \*leaf*, *char \*name*);

*X509\_VERIFY\_CTX* *\**\

**x509\_verify\_ctx\_new**(*STACK\_OF(X509) \*roots*);

*void*\

**x509\_verify\_ctx\_free**(*X509\_VERIFY\_CTX \*ctx*);

*int*\

**x509\_verify\_ctx\_set\_max\_depth**(*X509\_VERIFY\_CTX \*ctx*, *size\_t max*);

*int*\

**x509\_verify\_ctx\_set\_max\_signatures**(*X509\_VERIFY\_CTX \*ctx*, *size\_t max*);

*int*\

**x509\_verify\_ctx\_set\_max\_chains**(*X509\_VERIFY\_CTX \*ctx*, *size\_t max*);

*int*\

**x509\_verify\_ctx\_set\_purpose**(*X509\_VERIFY\_CTX \*ctx*, *int purpose\_id*);

*int*\

**x509\_verify\_ctx\_set\_intermediates**(*X509\_VERIFY\_CTX \*ctx*, *STACK\_OF(X509) \*intermediates*);

*const* *char* *\**\

**x509\_verify\_ctx\_error\_string**(*X509\_VERIFY\_CTX \*ctx*);

*size\_t*\

**x509\_verify\_ctx\_error\_depth**(*X509\_VERIFY\_CTX \*ctx*);

*STACK\_OF(X509)* *\**\

**x509\_verify\_ctx\_chain**(*X509\_VERIFY\_CTX \*ctx*, *size\_t index*);

## DESCRIPTION

The **x509\_verify**() function attempts to discover and validate all certificate chains for the *name* from the *leaf* certificate based on the parameters in *ctx*. Multiple chains may be built and validated. Revocation checking is not done by this function, and should be performed by the caller on any returned chains if so desired.

**x509\_verify\_ctx\_new**() allocates a new context using the trusted *roots*. In case of success, it increments the reference count of *roots*.

**x509\_verify\_ctx\_free**() frees *ctx* and decrements the reference count of the *roots* and *intermediates* associated with it. If *ctx* is NULL, no action occurs.

**x509\_verify\_ctx\_set\_max\_depth**() sets the maximum depth of certificate chains that will be constructed to *max*, which can be in the range from 1 to the default of 32.

**x509\_verify\_ctx\_set\_max\_signatures**() sets the maximum number of public key signature operations that will be used when verifying certificate chains to *max*, which can be in the range from 1 to 100000. The default is 256.

**x509\_verify\_ctx\_set\_max\_chains**() sets the maximum number of chains which may be returned to *max*, which can be in the range from 1 to the default of 8.

**x509\_verify\_ctx\_set\_purpose**() sets the certificate purpose for validation to *purpose\_id*. The X509\_PURPOSE\_\* constants listed in X509\_check\_purpose(3) can be used.

**x509\_verify\_ctx\_set\_intermediates**() provides some intermediate certificates, typically received from the peer, to be used for building chains. In case of success, this function increases the reference count of *intermediates*.

**x509\_verify\_ctx\_error\_string**() extracts a description of the last error encountered by a previous call to **x509\_verify**() from *ctx*.

**x509\_verify\_ctx\_error\_depth**() extracts the depth of the last error encountered by a previous call to **x509\_verify**() from *ctx*.

**x509\_verify\_ctx\_chain**() extracts the validated chain with the given *index* from *ctx* after a previous call to **x509\_verify**(). The *index* starts at 0, and it is an error to pass a number greater than or equal to the return value of **x509\_verify**(). The returned chain is neither copied, nor is its reference count increased.

## RETURN VALUES

**x509\_verify**() returns the number of chains successfully built and validated or 0 on failure.

**x509\_verify\_ctx\_new**() returns a newly allocated context or NULL on failure.

**x509\_verify\_ctx\_set\_max\_depth**(), **x509\_verify\_ctx\_set\_max\_signatures**(), **x509\_verify\_ctx\_set\_max\_chains**(), **x509\_verify\_ctx\_set\_purpose**(), and **x509\_verify\_ctx\_set\_intermediates**() return 1 on success or 0 on failure.

**x509\_verify\_ctx\_error\_string**() returns a pointer to a human readable error string. If no error occurred, "ok" is returned.

**x509\_verify\_ctx\_chain**() returns an internal pointer to a validated chain or NULL if *index* is greater than or equal to the number of chains that were successfully built and validated. The returned pointer becomes invalid when *ctx* is destroyed.

## SEE ALSO

X509\_verify\_cert(3)

## HISTORY

These functions first appeared in OpenBSD 6.8.

## AUTHORS

Bob Beck ⟨*beck@openbsd.org*⟩