1=pod 2 3=head1 NAME 4 5X509_sign, X509_sign_ctx, 6X509_REQ_sign, X509_REQ_sign_ctx, 7X509_ACERT_sign, X509_ACERT_sign_ctx, 8X509_CRL_sign, X509_CRL_sign_ctx - 9sign certificate, certificate request, or CRL signature 10 11=head1 SYNOPSIS 12 13 #include <openssl/x509.h> 14 15 int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md); 16 int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx); 17 18 int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md); 19 int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx); 20 21 int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md); 22 int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx); 23 24 #include <openssl/x509_acert.h> 25 26 int X509_ACERT_sign(X509_ACERT *x, EVP_PKEY *pkey, const EVP_MD *md); 27 int X509_ACERT_sign_ctx(X509_ACERT *x, EVP_MD_CTX *ctx); 28 29=head1 DESCRIPTION 30 31X509_sign() signs certificate I<x> using private key I<pkey> and message 32digest I<md> and sets the signature in I<x>. X509_sign_ctx() also signs 33certificate I<x> but uses the parameters contained in digest context I<ctx>. 34If the certificate information includes X.509 extensions, 35these two functions make sure that the certificate bears X.509 version 3. 36 37X509_REQ_sign(), X509_REQ_sign_ctx(), 38X509_ACERT_sign(), X509_ACERT_sign_ctx(), 39X509_CRL_sign(), and X509_CRL_sign_ctx() 40sign certificate requests and CRLs, respectively. 41 42=head1 NOTES 43 44X509_sign_ctx() is used where the default parameters for the corresponding 45public key and digest are not suitable. It can be used to sign keys using 46RSA-PSS for example. 47 48For efficiency reasons and to work around ASN.1 encoding issues the encoding 49of the signed portion of a certificate, certificate request and CRL is cached 50internally. If the signed portion of the structure is modified the encoding 51is not always updated meaning a stale version is sometimes used. This is not 52normally a problem because modifying the signed portion will invalidate the 53signature and signing will always update the encoding. 54 55=head1 RETURN VALUES 56 57All functions return the size of the signature 58in bytes for success and zero for failure. 59 60=head1 SEE ALSO 61 62L<ERR_get_error(3)>, 63L<X509_NAME_add_entry_by_txt(3)>, 64L<X509_new(3)>, 65L<X509_verify_cert(3)>, 66L<X509_verify(3)>, 67L<X509_REQ_verify_ex(3)>, L<X509_REQ_verify(3)>, 68L<X509_CRL_verify(3)> 69 70=head1 HISTORY 71 72The X509_sign(), X509_REQ_sign() and X509_CRL_sign() functions are 73available in all versions of OpenSSL. 74 75The X509_sign_ctx(), X509_REQ_sign_ctx() 76and X509_CRL_sign_ctx() functions were added in OpenSSL 1.0.1. 77 78The X509_ACERT_sign() and X509_ACERT_sign_ctx() functions were added 79in OpenSSL 3.4. 80 81=head1 COPYRIGHT 82 83Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved. 84 85Licensed under the Apache License 2.0 (the "License"). You may not use 86this file except in compliance with the License. You can obtain a copy 87in the file LICENSE in the source distribution or at 88L<https://www.openssl.org/source/license.html>. 89 90=cut 91
