X509_check_ca - check if given certificate is CA certificate

       Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.

       Licensed under the Apache License 2.0 (the "License").  You may not use this file except in compliance
       with the License.  You can obtain a copy in the file LICENSE in the source distribution or at
       <https://www.openssl.org/source/license.html>.

3.5.0                                              2025-06-04                                X509_CHECK_CA(3SSL)

       This function checks if given certificate is CA certificate (can be used to sign other certificates). The
       certificate must be a complete certificate otherwise an error is returned.

       X509_check_ca - check if given certificate is CA certificate

       Function return 0, if it is not CA certificate, 1 if it is proper X509v3 CA certificate with
       basicConstraints extension CA:TRUE, 3, if it is self-signed X509 v1 certificate, 4, if it is certificate
       with keyUsage extension with bit keyCertSign set, but without basicConstraints, and 5 if it has outdated
       Netscape Certificate Type extension telling that it is CA certificate.

       This function will also return 0 on error.

       Actually, any nonzero value means that this certificate could have been used to sign other certificates.

X509_verify_cert(3), X509_check_issued(3), X509_check_purpose(3)

        #include <openssl/x509v3.h>

        int X509_check_ca(X509 *cert);