X509_NAME_GET_INDEX_BY_NID(3) | Library Functions Manual | X509_NAME_GET_INDEX_BY_NID(3)

# NAME

`X509_NAME_get_index_by_NID`, `X509_NAME_get_index_by_OBJ`, `X509_NAME_entry_count`, `X509_NAME_get_entry`, `X509_NAME_get_text_by_NID`, `X509_NAME_get_text_by_OBJ` — X509_NAME lookup and enumeration functions

# SYNOPSIS

library “libcrypto”
`#include <openssl/x509.h>`

int
`X509_NAME_get_index_by_NID`(const X509_NAME *name, int nid, int lastpos);

int
`X509_NAME_get_index_by_OBJ`(const X509_NAME *name, const ASN1_OBJECT *obj, int lastpos);

int
`X509_NAME_entry_count`(const X509_NAME *name);

X509_NAME_ENTRY *
`X509_NAME_get_entry`(const X509_NAME *name, int loc);

int
`X509_NAME_get_text_by_NID`(X509_NAME *name, int nid, char *buf, int len);

int
`X509_NAME_get_text_by_OBJ`(X509_NAME *name, const ASN1_OBJECT *obj, char *buf, int len);

# DESCRIPTION

These functions allow an X509_NAME structure to be examined. The X509_NAME structure is the same as the ASN.1 Name type defined in RFC 2459 (and elsewhere) and used, for example, in certificate subject and issuer names.

`X509_NAME_get_index_by_NID`() and `X509_NAME_get_index_by_OBJ`() retrieve the next index matching nid or obj after lastpos. lastpos should initially be set to -1.

`X509_NAME_get_entry`() retrieves the X509_NAME_ENTRY from name corresponding to index loc. Acceptable values for loc run from 0 to `X509_NAME_entry_count`(name) - 1.

`X509_NAME_get_text_by_NID`() and `X509_NAME_get_text_by_OBJ`() retrieve the bytes encoded as UTF-8 from the first entry in name which matches nid or obj. If buf is `NULL`, nothing is written, but the return value is calculated as usual. If buf is not `NULL`, no more than len bytes will be written and the text written to buf will be NUL terminated.

If len is not large enough to hold the NUL byte terminated UTF-8 encoding of the text, or if the UTF-8 encoding of the text would contains a NUL byte, no data will be written and the call will return failure.

All relevant `NID_*` and `OBJ_*` codes can be found in the `<openssl/objects.h>` header file.

Applications which could pass invalid NIDs to `X509_NAME_get_index_by_NID`() should check for the return value of -2. Alternatively the NID validity can be determined first by checking that `OBJ_nid2obj`(nid) is not `NULL`.

# RETURN VALUES

`X509_NAME_get_index_by_NID`() returns the index of the next matching entry, -1 if not found, or -2 if the nid does not correspond to a valid OID.

`X509_NAME_get_index_by_OBJ`() returns the index of the next matching entry or -1 if not found.

`X509_NAME_entry_count`() returns the total number of entries in name.

`X509_NAME_get_entry`() returns an internal pointer which must not be freed by the caller or `NULL` if the index is invalid.

`X509_NAME_get_text_by_NID`() and `X509_NAME_get_text_by_OBJ`() return the length of the output UTF-8 string written, not counting the terminating NUL, or -1 in the case of an error or no match being found.

In some cases of failure of `X509_NAME_get_index_by_NID`() and `X509_NAME_get_text_by_NID`(), the reason can be determined with ERR_get_error(3).

# EXAMPLES

Process all entries:

    int i;
    X509_NAME_ENTRY *e;

    for (i = 0; i < X509_NAME_entry_count(nm); i++) {
    	e = X509_NAME_get_entry(nm, i);
    	/* Do something with e */
    }

Process all commonName entries:

    int lastpos = -1;
    X509_NAME_ENTRY *e;

    for (;;) {
    	lastpos = X509_NAME_get_index_by_NID(nm, NID_commonName, lastpos);
    	if (lastpos == -1)
    		break;
    	e = X509_NAME_get_entry(nm, lastpos);
    	/* Do something with e */
    }

# SEE ALSO

d2i_X509_NAME(3), X509_NAME_ENTRY_get_object(3), X509_NAME_new(3)

# HISTORY

These functions first appeared in SSLeay 0.8.0 and have been available since OpenBSD 2.4.

# CAVEATS

`X509_NAME_get_text_by_NID`() and `X509_NAME_get_text_by_OBJ`() are legacy functions which have various limitations which make them of minimal use in practice. They can only find the first matching entry and will copy the contents of the field verbatim: this can be highly confusing if the target is a multicharacter string type like a BMPString or a UTF8String.

For a more general solution, `X509_NAME_get_index_by_NID`() or `X509_NAME_get_index_by_OBJ`() should be used, followed by `X509_NAME_get_entry`() on any matching indices and then the various X509_NAME_ENTRY utility functions on the result.

June 8, 2025 | Debian