libressl-X509_sign3
Sign or verify certificate, certificate request, or crl signature
Usage
Crypto Library (libcrypto, -lcrypto)
#include <openssl/x509.h>
int
X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
int
X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx);
int
X509_verify(X509 *x, EVP_PKEY *pkey);
int
X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md);
int
X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx);
int
X509_REQ_verify(X509_REQ *x, EVP_PKEY *pkey);
int
X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md);
int
X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx);
int
X509_CRL_verify(X509_CRL *x, EVP_PKEY *pkey);
Overview
X509_sign() signs the certificate x using the private key pkey and the message digest md and sets the signature in x. X509_sign_ctx() also signs the certificate x but uses the parameters contained in digest context ctx.
X509_verify() verifies the signature of certificate x using the public key pkey. Only the signature is checked: no other checks (such as certificate chain validity) are performed.
X509_REQ_sign(), X509_REQ_sign_ctx(), X509_REQ_verify(), X509_CRL_sign(), X509_CRL_sign_ctx(), and X509_CRL_verify() sign and verify certificate requests and CRLs, respectively.
X509_sign_ctx() is used where the default parameters for the corresponding public key and digest are not suitable. It can be used to sign keys using RSA-PSS for example.
Return values
X509_sign(), X509_sign_ctx(), X509_REQ_sign(), X509_REQ_sign_ctx(), X509_CRL_sign(), and X509_CRL_sign_ctx() return the size of the signature in bytes for success or 0 for failure.
X509_verify(), X509_REQ_verify(), and X509_CRL_verify() return 1 if the signature is valid or 0 if the signature check fails. If the signature could not be checked at all because it was invalid or some other error occurred, then -1 is returned.
In some cases of failure, the reason can be determined with ERR_get_error(3).