SSL_get_peer_certificate3ssl
Get the x509 certificate of the peer
Usage
#include <openssl/ssl.h>X509 *SSL_get0_peer_certificate(const SSL *ssl);X509 *SSL_get1_peer_certificate(const SSL *ssl);
The following function has been deprecated since OpenSSL 3.0, and can be hidden entirely by defining OPENSSL_API_COMPAT with a suitable version value, see openssl_user_macros(7):
X509 *SSL_get_peer_certificate(const SSL *ssl);Overview
These functions return a pointer to the X509 certificate the peer presented. If the peer did not present a certificate, NULL is returned.
Notes
Due to the protocol definition, a TLS/SSL server will always send a certificate, if present. A client will only send a certificate when explicitly requested to do so by the server (see SSL_CTX_set_verify(3)). If an anonymous cipher is used, no certificates are sent.
That a certificate is returned does not indicate information about the verification state, use SSL_get_verify_result(3) to check the verification state.
The reference count of the X509 object returned by SSL_get1_peer_certificate() is incremented by one, so that it will not be destroyed when the session containing the peer certificate is freed. The X509 object must be explicitly freed using X509_free().
The reference count of the X509 object returned by SSL_get0_peer_certificate() is not incremented, and must not be freed.
SSL_get_peer_certificate() is an alias of SSL_get1_peer_certificate().
Return values
The following return values can occur:
NULL
|
No certificate was presented by the peer or no connection was established. |
|---|---|
Pointer to an X509 certificate
|
The return value points to the certificate presented by the peer. |
Releases
13 releases since Debian 3.0 (Woody); the text changed 12 times.