PEM_READ_BIO_EX(3ossl)

okay bestie, welcome to OpenSSL’s PEM_READ_BIO_EX(3ossl) manual page — this one is lowkey niche but honestly kind of iconic if you’re doing custom PEM processing. 💅

✨ NAME ✨

• PEM_read_bio_ex, PEM_FLAG_SECURE, PEM_FLAG_EAY_COMPATIBLE, PEM_FLAG_ONLY_B64 — read PEM format files with custom processing. no cap, that’s the whole vibe. 🎀

🛠️ SYNOPSIS 🛠️

#include <openssl/pem.h>

#define PEM_FLAG_SECURE             0x1
#define PEM_FLAG_EAY_COMPATIBLE     0x2
#define PEM_FLAG_ONLY_B64           0x4
int PEM_read_bio_ex(BIO *in, char **name, char **header,
                    unsigned char **data, long *len, unsigned int flags);

💖 DESCRIPTION 💖

PEM_read_bio_ex() reads in PEM formatted data from an input BIO, and it outputs these three things, bestie:

• the name of the type of contained data,
• the header information regarding the possibly encrypted data, and
• the binary data payload (after base64 decoding).

It should generally only be used to implement PEM_read_bio_-family functions for specific data types or other usage, but is exposed to allow greater flexibility over how processing is performed, if needed. ✨

Now let’s talk flags, because the flags are literally the main character here:

• PEM_FLAG_SECURE — if this is set, the intermediate buffers used to read in lines of input are allocated from the secure heap. 🛡️
• PEM_FLAG_EAY_COMPATIBLE — if this is set, a simple algorithm is used to remove whitespace and control characters from the end of each line, so as to be compatible with the historical behavior of PEM_read_bio(). 🕰️
• PEM_FLAG_ONLY_B64 — if this is set, all characters are required to be valid base64 characters (or newlines); non-base64 characters are treated as end of input. 🧼
• If neither PEM_FLAG_EAY_COMPATIBLE or PEM_FLAG_ONLY_B64 is set, control characters are ignored. 🙈
• If both PEM_FLAG_EAY_COMPATIBLE and PEM_FLAG_ONLY_B64 are set, an error is returned; these options are not compatible with each other. 💀

bestie, do not mix PEM_FLAG_EAY_COMPATIBLE and PEM_FLAG_ONLY_B64 — that combo is a no-go and it will error out. periodt. 🚫

📝 NOTES 📝

The caller must release the storage allocated for *name, *header, and *data. If PEM_FLAG_SECURE was set, use OPENSSL_secure_free(); otherwise, OPENSSL_free() is used. 🫶

don’t leave that storage hanging, bestie — free it with the right free-er. 😭

🫶 RETURN VALUES 🫶

PEM_read_bio_ex() returns 1 for success or 0 for failure. that’s it, that’s the return value story. 💖

👀 SEE ALSO 👀

PEM_bytes_read_bio(3) — go peek if you need the related lore. 🦋

🌸 HISTORY 🌸

The PEM_read_bio_ex() function was added in OpenSSL 1.1.1. 🎀

©️ COPYRIGHT ©️

Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the “License”). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

---

okay bestie, that’s the whole page! 💖 this is OpenSSL 3.5.6, dated 2026-04-07, and you were reading PEM_READ_BIO_EX(3ossl) — now go be the main character of your PEM parsing. 🎀✨