libressl-X509_check_ca(3)

libressl-X509_check_ca3

Check whether a certificate is a ca certificate

Usage

Crypto Library (libcrypto, -lcrypto)

#include <openssl/x509v3.h>

int

X509_check_ca(X509 *cert);

Overview

The X509_check_ca() function checks whether the given certificate is a CA certificate, that is, whether it can be used to sign other certificates.

Return values

If cert is a CA certificate, a non-zero value is returned; 0 otherwise.

The following return values identify specific kinds of CA certificates:

1

an X.509 v3 CA certificate with basicConstraints extension CA:TRUE

3

a self-signed X.509 v1 certificate

4

a certificate with keyUsage extension with bit keyCertSign set, but without basicConstraints

5

a certificate with an outdated Netscape Certificate Type extension telling that it is a CA certificate

History

X509_check_ca() first appeared in OpenSSL 0.9.7f and has been available since OpenBSD 3.8.

Bugs

If X509_check_ca() fails to cache X509v3 extension values, it may fail to recognize a CA certificate. An application should call X509_check_purpose(3) with a purpose argument of -1, ensuring that the X509v3 extensions are cached, before calling X509_check_ca().

From libressl 4.4.0-1 in Arch Linux 2026-11-01. Parsed by carta from the page's mdoc source.