ASN1_ITEM_SIGN(3)

💖 ASN1_ITEM_SIGN(3) — DER-encode and sign an ASN.1 value 💖

okay bestie, welcome to the ASN1_ITEM_SIGN(3) page from the Library Functions Manual. ✨ We’re doing DER encoding, signing, and all the little algorithm-parameter details — stay with me, it’s actually iconic.

🌸 NAME 🌸

ASN1_item_sign, ASN1_item_sign_ctx — DER-encode and sign an ASN.1 value 🎀

✨ SYNOPSIS ✨

library: “libcrypto” 🫶

#include <openssl/x509.h>

int
ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1,
    X509_ALGOR *algor2, ASN1_BIT_STRING *sig_out, void *val_in,
    EVP_PKEY *pkey, const EVP_MD *type);

int
ASN1_item_sign_ctx(const ASN1_ITEM *it, X509_ALGOR *algor1,
    X509_ALGOR *algor2, ASN1_BIT_STRING *sig_out, void *val_in,
    EVP_MD_CTX *ctx);

🦋 DESCRIPTION 🦋

So ASN1_item_sign() is out here assuming that val_in is an ASN1_VALUE of the type specified by it. It encodes that into DER format by calling ASN1_item_i2d(3), and then signs the resulting byte array in a way similar to EVP_DigestSign(3), using a signing context created with EVP_DigestSignInit(3) for the given digest type and private key pkey. 🔥

The created signature gets placed into the sig_out object provided by the caller, freeing and replacing any data already contained in that object. No cap, it really does clear out the old stuff. 💅

ASN1_item_sign_ctx() is similar, except the provided ctx is used rather than creating a new one. And listen: no matter whether ASN1_item_sign_ctx() succeeds or fails, EVP_MD_CTX_cleanup(3) is called on ctx before returning. That cleanup is happening either way, bestie. 🧚

For both functions, unless algor1 is NULL, its algorithm OID and parameter type are set according to the digest type used, and its parameter value is cleared. In RSA-PSS mode, the parameter value is also copied into algor1. Unless algor2 is NULL, the same data is copied into it. 🎀

💫 RETURN VALUES 💫

These functions return the length of the signature in bytes or 0 if memory allocation, encoding, or signing fails. 😭

ASN1_item_sign_ctx() also fails and returns 0 if ctx is not fully initialized. That’s the vibe check: not fully initialized means no signature for you. 💀

🔗 SEE ALSO 🔗

• ASN1_BIT_STRING_new(3)
• ASN1_item_digest(3)
• ASN1_item_i2d(3)
• ASN1_item_verify(3)
• EVP_Digest(3)
• EVP_DigestSign(3)
• EVP_MD_CTX_new(3)
• EVP_PKEY_new(3)
• OBJ_find_sigid_by_algs(3)
• X509_ALGOR_new(3)

📜 HISTORY 📜

ASN1_item_sign() first appeared in OpenSSL 0.9.7 and has been available since OpenBSD 3.1. 🌈

ASN1_item_sign_ctx() first appeared in OpenSSL 1.0.1 and has been available since OpenBSD 5.3. ⭐

---

xoxo, Debian 💖 — June 8, 2025 — that’s the ASN1_ITEM_SIGN(3) tea, and you are officially signed, sealed, DER-encoded, and delivered. 💅✨