X509_check_ca.3ssl - Man Page

check if given certificate is CA certificate


 #include <openssl/x509v3.h>

 int X509_check_ca(X509 *cert);


This function checks if given certificate is CA certificate (can be used to sign other certificates).

Return Values

Function return 0, if it is not CA certificate, 1 if it is proper X509v3 CA certificate with basicConstraints extension CA:TRUE, 3, if it is self-signed X509 v1 certificate, 4, if it is certificate with keyUsage extension with bit keyCertSign set, but without basicConstraints, and 5 if it has outdated Netscape Certificate Type extension telling that it is CA certificate.

Actually, any nonzero value means that this certificate could have been used to sign other certificates.

See Also

X509_verify_cert(3), X509_check_issued(3), X509_check_purpose(3)

Referenced By

EVP_PKEY_ASN1_METHOD.3ssl(3), X509_check_issued.3ssl(3).

2021-03-26 1.1.1k OpenSSL