PKCS12_SAFEBAG_GET1_CERT(3ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

🎀 PKCS12_SAFEBAG_GET1_CERT — the 3ossl manual, bestie edition

okay so real talk, this whole page is about pulling stuff out of a PKCS12_SAFEBAG — which is like the little ziplock baggie inside a PKCS#12 file that holds exactly one treasure (a cert, a CRL, a key, a secret, or a whole other bag of bags, we love recursion 💅). The manual name is PKCS12_SAFEBAG_GET1_CERT(3ossl) but honestly this page is a whole friend group of getters, not just one. Let's get into it ✨

💖 NAME

PKCS12_SAFEBAG_get0_attr, PKCS12_SAFEBAG_get0_type, PKCS12_SAFEBAG_get_nid, PKCS12_SAFEBAG_get_bag_nid, PKCS12_SAFEBAG_get0_bag_obj, PKCS12_SAFEBAG_get0_bag_type, PKCS12_SAFEBAG_get1_cert_ex, PKCS12_SAFEBAG_get1_cert, PKCS12_SAFEBAG_get1_crl_ex, PKCS12_SAFEBAG_get1_crl, PKCS12_SAFEBAG_get0_safes, PKCS12_SAFEBAG_get0_p8inf, PKCS12_SAFEBAG_get0_pkcs8 — get objects from a PKCS#12 safeBag 🫶

✨ SYNOPSIS ✨

#include <openssl/pkcs12.h>

const ASN1_TYPE *PKCS12_SAFEBAG_get0_attr(const PKCS12_SAFEBAG *bag,
                                          int attr_nid);
const ASN1_OBJECT *PKCS12_SAFEBAG_get0_type(const PKCS12_SAFEBAG *bag);
int PKCS12_SAFEBAG_get_nid(const PKCS12_SAFEBAG *bag);
int PKCS12_SAFEBAG_get_bag_nid(const PKCS12_SAFEBAG *bag);
const ASN1_TYPE *PKCS12_SAFEBAG_get0_bag_obj(const PKCS12_SAFEBAG *bag);
const ASN1_OBJECT *PKCS12_SAFEBAG_get0_bag_type(const PKCS12_SAFEBAG *bag);
X509_CRL *PKCS12_SAFEBAG_get1_cert_ex(const PKCS12_SAFEBAG *bag,
                                      OSSL_LIB_CTX *libctx, const char *propq);
X509 *PKCS12_SAFEBAG_get1_cert(const PKCS12_SAFEBAG *bag);
X509_CRL *PKCS12_SAFEBAG_get1_crl_ex(const PKCS12_SAFEBAG *bag,
                                     OSSL_LIB_CTX *libctx, const char *propq);
X509_CRL *PKCS12_SAFEBAG_get1_crl(const PKCS12_SAFEBAG *bag);
const STACK_OF(PKCS12_SAFEBAG) *PKCS12_SAFEBAG_get0_safes(const PKCS12_SAFEBAG *bag);
const PKCS8_PRIV_KEY_INFO *PKCS12_SAFEBAG_get0_p8inf(const PKCS12_SAFEBAG *bag);
const X509_SIG *PKCS12_SAFEBAG_get0_pkcs8(const PKCS12_SAFEBAG *bag);

no cap, just copy that block straight into your file and you're so back 🔥

🌸 DESCRIPTION 🌸

So. Every one of these is a little key that opens the safeBag and hands you a different thing. Let's go one by one, bestie, no skipping 👑

  • PKCS12_SAFEBAG_get0_attr() — gets the attribute value that corresponds to the attr_nid. That's it, that's the whole vibe.
  • PKCS12_SAFEBAG_get0_type() — gets the safeBag type as an OID. Meanwhile PKCS12_SAFEBAG_get_nid() gets the safeBag type as an NID instead. That NID could be NID_certBag, NID_crlBag, NID_keyBag, NID_secretBag, NID_safeContentsBag or NID_pkcs8ShroudedKeyBag. so many bags, so little time 👜
  • PKCS12_SAFEBAG_get_bag_nid() — gets the type of the object contained within the PKCS12_SAFEBAG. For most bags this matches the bag type, but for secretBags it can be arbitrary (chaotic queen behavior, honestly). And PKCS12_SAFEBAG_get0_bag_type() gets this same type as an OID. iykyk 💫
  • PKCS12_SAFEBAG_get0_bag_obj() — retrieves the actual object contained within the safeBag. the main character itself 😭
  • PKCS12_SAFEBAG_get1_cert_ex() and PKCS12_SAFEBAG_get1_crl_ex() — return new X509 or X509_CRL objects from the item in the safeBag. libctx and propq are used when fetching algorithms, and may optionally be set to NULL. the _ex versions are the ones that let you pick your own context, love that for us 🦋
  • PKCS12_SAFEBAG_get1_cert() and PKCS12_SAFEBAG_get1_crl() — same as PKCS12_SAFEBAG_get1_cert_ex() and PKCS12_SAFEBAG_get1_crl_ex(), except they set the libctx and prop to NULL. Which means they use the default library context. convenient! 💅
  • PKCS12_SAFEBAG_get0_p8inf() and PKCS12_SAFEBAG_get0_pkcs8() — return the PKCS8 object from a PKCS8shroudedKeyBag or a keyBag. shrouded... mysterious... iconic 🔮
  • PKCS12_SAFEBAG_get0_safes() — retrieves the set of safeBags contained within a safeContentsBag. yes bestie, bags inside bags. it's giving inception 🎀

💀 RETURN VALUES 💀

  • PKCS12_SAFEBAG_get_nid() and PKCS12_SAFEBAG_get_bag_nid() return the NID of the safeBag or bag object — or -1 if there's no corresponding NID. (not found, not slaying, sad 🥲)
  • Every other function returns a valid object of the specified type, or NULL if an error occurred.
so when you get NULL back, that's your signal to check the error stack. don't just keep vibing and hope for the best 🙈

🌈 SEE ALSO 🌈

⭐ HISTORY ⭐

The functions PKCS12_SAFEBAG_get1_cert_ex() and PKCS12_SAFEBAG_get1_crl_ex() were added in OpenSSL 3.2. newer kids on the block, and we stan 💜

Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, you ate that 🍓 this was the 3.5.6 edition, dated 2026-04-07, from the PKCS12_SAFEBAG_GET1_CERT(3ossl) manual — mwah, go read your certs responsibly 💖✨

📦 where this page comes from