---
name: "ne_ssl_clicert_read"
section: "3"
platform: "linux"
package: "neon"
version: "0.37.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/ne_ssl_clicert_read"
---

# ne\_ssl\_clicert\_read(3)

SSL client certificate handling

## NAME

ne\_ssl\_clicert\_read, ne\_ssl\_clicert\_import, ne\_ssl\_clicert\_fromuri, ne\_ssl\_clicert\_name, ne\_ssl\_clicert\_encrypted, ne\_ssl\_clicert\_decrypt, ne\_ssl\_clicert\_owner, ne\_ssl\_clicert\_free - SSL client certificate handling

## SYNOPSIS

```
#include <ne_ssl.h>
```

**ne\_ssl\_client\_cert \*ne\_ssl\_clicert\_read(const char \****filename***);**

**ne\_ssl\_client\_cert \*ne\_ssl\_clicert\_import(const unsigned char \****filename***, size\_t** *buflen***);**

**ne\_ssl\_client\_cert \*ne\_ssl\_clicert\_fromuri(const char \****uri***, unsigned** *flags***);**

**const char \*ne\_ssl\_clicert\_name(const ne\_ssl\_client\_cert \****ccert***);**

**int ne\_ssl\_clicert\_encrypted(const ne\_ssl\_client\_cert \****ccert***);**

**int ne\_ssl\_clicert\_decrypt(ne\_ssl\_client\_cert \****ccert***, const char \****password***);**

**const ne\_ssl\_certificate \*ne\_ssl\_clicert\_owner(const ne\_ssl\_client\_cert \****ccert***);**

**void ne\_ssl\_clicert\_free(ne\_ssl\_client\_cert \****ccert***);**

## DESCRIPTION

The **ne\_ssl\_clicert\_read** function reads a client certificate from a PKCS#12-formatted file, and returns an **ne\_ssl\_client\_cert** object. The **ne\_ssl\_clicert\_import** function reads a client certificate from a memory buffer using the PKCS#12 format. The **ne\_ssl\_clicert\_fromuri** function loads a client certificate from a URI. URI schemes supported are defined by the SSL/TLS toolkit, and may include **PKCS#11 URIs**\[1\].

A **ne\_ssl\_client\_cert** object represents both a client certificate and the associated private key; the term "client certificate" is used here to refer to this pair. A client certificate object loaded by any of the above functions can be in one of two states: *encrypted* or *decrypted*. The **ne\_ssl\_clicert\_encrypted** function will return non-zero if the client certificate is in the *encrypted* state.

A client certificate *must* be in the decrypted state before it is associated with a session. **ne\_ssl\_clicert\_decrypt** can be used to decrypt a client certificate using the appropriate password. This function must only be called if the object is in the *encrypted* state; if decryption fails, the certificate state does not change, so decryption can be attempted more than once using different passwords.

A client certificate can be given a "friendly name" when it is created; **ne\_ssl\_clicert\_name** will return this name (or NULL if no friendly name was specified). **ne\_ssl\_clicert\_name** can be used when the client certificate is in either the encrypted or decrypted state, and will return the same string for the lifetime of the object.

The function **ne\_ssl\_clicert\_owner** returns the certificate part of the client certificate; it must only be called if the client certificate is in the *decrypted* state.

When the client certificate object is no longer needed, the **ne\_ssl\_clicert\_free** function should be used to destroy the object.

## RETURN VALUE

**ne\_ssl\_clicert\_read**, **ne\_ssl\_clicert\_import** and **ne\_ssl\_clicert\_fromuri** all return a client certificate object, or NULL if the certificate could not be read/imported. **ne\_ssl\_clicert\_encrypted** returns zero if the object is in the decrypted state, or non-zero if it is in the encrypted state. **ne\_ssl\_clicert\_name** returns a NUL-terminated friendly name string, or NULL. **ne\_ssl\_clicert\_owner** returns a certificate object.

## EXAMPLES

The following code reads a client certificate and decrypts it if necessary, then loads it into an HTTP session.

```
ne_ssl_client_cert *ccert;
ccert = ne_ssl_clicert_read("/path/to/client.p12");
if (ccert == NULL) {
   /* handle error... */
} else if (ne_ssl_clicert_encrypted(ccert)) {
   char *password = prompt_for_password();
   if (ne_ssl_clicert_decrypt(ccert, password)) {
      /* could not decrypt! handle error... */
   }
}
ne_ssl_set_clicert(sess, ccert);
```

## HISTORY

**ne\_ssl\_clicert\_import** was added in neon 0.30.0. **ne\_ssl\_clicert\_fromuri** was added in neon 0.35.0.

## SEE ALSO

[**ne\_ssl\_cert\_read**(3)](/ne_ssl_cert_read/3.md)

## COPYRIGHT

Copyright © 2001-2026 Joe Orton\

## REFERENCES

- 1\.

  PKCS#11 URIs

  https://www.rfc-editor.org/rfc/rfc7512.html