PKCS12_ADD_SAFE(3ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💅 PKCS12_ADD_SAFE 💅

okay bestie, so this is the 3ossl page for the PKCS#12 safe-bag squad — four functions that build PKCS#12 structures and shove objects into them. no cap, it's giving "assembly instructions for a very specific little box." let's go ✨

✨ SYNOPSIS ✨

like, the actual receipts 🧾

#include <openssl/pkcs12.h>

int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags,
                    int safe_nid, int iter, const char *pass);
int PKCS12_add_safe_ex(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags,
                       int safe_nid, int iter, const char *pass,
                       OSSL_LIB_CTX *ctx, const char *propq);

PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int p7_nid);
PKCS12 *PKCS12_add_safes_ex(STACK_OF(PKCS7) *safes, int p7_nid,
                            OSSL_LIB_CTX *ctx, const char *propq);

🎀 DESCRIPTION 🎀

so PKCS12_add_safe() is the main character here 👑 — it creates a brand-new PKCS7 contentInfo holding all the PKCS12_SAFEBAGs you handed it, then adds that to a whole set of PKCS7 contentInfos. and literally what kind of thing it becomes? that depends on safe_nid:

  • 🫶 if safe_nid is -1, you get a plain PKCS7 data contentInfo. simple. clean. iconic.
  • 🔐 if safe_nid is a valid PBE algorithm NID, you get a PKCS7 encryptedData contentInfo. it uses pass as the passphrase and iter as the iteration count. and listen — if iter is zero, it just quietly uses a default iteration count of 2048. periodt.
  • 🌸 if safe_nid is 0, you get a PKCS7 encryptedData contentInfo too, but built with a default encryption algorithm — currently NID_pbe_WithSHA1And3_Key_TripleDES_CBC.

then PKCS12_add_safe_ex() — she's identical to PKCS12_add_safe(), no notes, but she lets you pass a library context ctx and a property query propq so the algorithm implementations get picked with those. iykyk 💅

PKCS12_add_safes() builds a PKCS12 structure containing the supplied set of PKCS7 contentInfos. the safes get tucked inside a PKCS7 contentInfo of type p7_nid first. and rn? the only supported type is NID_pkcs7_data. that's it. that's the list. 🙈

PKCS12_add_safes_ex() — same energy as PKCS12_add_safes(), but again with ctx and propq for picking algorithm implementations. slay ✨

🦋 NOTES 🦋

heads up bestie, PKCS12_add_safe() makes assumptions about how your pass phrase is encoded 😭. like, it's not out here asking questions. see passphrase-encoding(7) for the whole story.

⭐ RETURN VALUES ⭐

  • PKCS12_add_safe() — returns 1 for success, 0 for failure. that's the whole vibe check.
  • PKCS12_add_safes() — returns a valid PKCS12 structure, or NULL if something went wrong 💀.

🌈 CONFORMING TO 🌈

IETF RFC 7292 — and yeah, the source lists it as https://tools.ietf.org/html/rfc7292 🧚

🔥 SEE ALSO 🔥

PKCS12_create(3) — go read that one too, bestie 🫶

💜 HISTORY 💜

PKCS12_add_safe_ex() and PKCS12_add_safes_ex() are the new girls — they were added in OpenSSL 3.0. 🎀

Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

fr fr, read the license before you copy the file. it's not optional, bestie. ⚠️

okay that's the whole page!! mwah 💋 this was OpenSSL 3.5.6, dated 2026-04-07, and the manual name is PKCS12_ADD_SAFE(3ossl) — catch you on the next one, love u, bye!! 🍓🦋✨

📦 where this page comes from