NAME

       X509_check_ca - check if given certificate is CA certificate

SYNOPSIS

        #include <openssl/x509v3.h>

        int X509_check_ca(X509 *cert);

DESCRIPTION

       This function checks if given certificate is CA certificate (can be used to sign other
       certificates). The certificate must be a complete certificate otherwise an error is
       returned.

RETURN VALUES

       Function return 0, if it is not CA certificate, 1 if it is proper X509v3 CA certificate
       with basicConstraints extension CA:TRUE, 3, if it is self-signed X509 v1 certificate, 4,
       if it is certificate with keyUsage extension with bit keyCertSign set, but without
       basicConstraints, and 5 if it has outdated Netscape Certificate Type extension telling
       that it is CA certificate.

       This function will also return 0 on error.

       Actually, any nonzero value means that this certificate could have been used to sign other
       certificates.

SEE ALSO

       X509_verify_cert(3), X509_check_issued(3), X509_check_purpose(3)

COPYRIGHT

       Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.

       Licensed under the Apache License 2.0 (the "License").  You may not use this file except
       in compliance with the License.  You can obtain a copy in the file LICENSE in the source
       distribution or at <https://www.openssl.org/source/license.html>.