SMIME_WRITE_PKCS7(3ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💌 SMIME_WRITE_PKCS7 — the 3ossl glow-up

okay bestie, settle in, because this one is genuinely a little baddie 💅 It's SMIME_write_PKCS7, it lives in the OpenSSL 3ossl manual family, and its whole personality is: take your PKCS#7 structure and dress it up in S/MIME format so it can go out into the world looking correct. Obsessed.

✨ NAME ✨

SMIME_write_PKCS7 — the icon that converts a PKCS#7 structure into S/MIME format 🎀

🦋 SYNOPSIS 🦋

#include <openssl/pkcs7.h>

int SMIME_write_PKCS7(BIO *out, PKCS7 *p7, BIO *data, int flags);

That's the whole fit. One function call, four arguments, no drama (well, mostly no drama 😭).

🌸 DESCRIPTION 🌸

So what does SMIME_write_PKCS7() actually do? It slaps the appropriate MIME headers onto a PKCS#7 structure and produces a full S/MIME message. It's giving "glow-up montage" ✨

The arguments, one by one, no skips:

  • out — the BIO you're writing the data to. That's the destination, the runway, the place the message goes 💖
  • p7 — the PKCS7 structure. The appropriate one. Yes, specifically the appropriate one, quote me.
  • data — if streaming is enabled, then the content must be supplied in this argument. Non-negotiable, no cap.
  • flags — an optional set of flags. Optional! But iconic when used 🫶

👑 NOTES 👑

okay so here's where it gets juicy — the following flags can be passed in the flags parameter 👇

  • PKCS7_DETACHED — when it's set, cleartext signing will be used. Lowkey important: this option only makes sense for signedData where PKCS7_DETACHED is also set when PKCS7_sign() is also called. Both places or it's not giving what it needs to give 💀
  • PKCS7_TEXT — when it's set, MIME headers for type text/plain are added to the content. And this only makes sense if PKCS7_DETACHED is also set. It's a package deal 🎁
  • PKCS7_STREAM — when it's set, streaming is performed. But bestie, careful: this flag should only be set if PKCS7_STREAM was also set in the previous call to PKCS7_sign() or PKCS7_encrypt(). Consistency is the whole vibe here 🌈
Small heads-up on reading it twice 😭 — if cleartext signing is being used and PKCS7_STREAM is not set, then the data must be read twice: once to compute the signature in PKCS7_sign(), and once to output the S/MIME message. Two passes, one message. It's giving "went back for a second look" 🙈

And about the output format, because this matters:

If streaming is performed, the content is output in BER format using indefinite length constructed encoding — except in the case of signed data with detached content, where the content is absent and DER format is used. Little exception, big deal ⭐

💀 BUGS 💀

Honest hour: SMIME_write_PKCS7() always base64 encodes PKCS#7 structures, and there should be an option to disable this. There isn't one. That's the bug note team. Not me making it up, it's right there in the source docs 🍓

⭐ RETURN VALUES ⭐

Super simple, super slay:

  • 1 — success 👑
  • 0 — failure 😭

That's it. Binary baddie behaviour.

🔥 SEE ALSO 🔥

Go read these next, bestie, they're the friend group:

Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

💜 And that's the page! Brought to you by OpenSSL 3.5.6, dated 2026-04-07 — thanks for reading my lil SMIME_WRITE_PKCS7(3ossl) era, mwah 🫶✨
📦 where this page comes from