CMS_VERIFY_RECEIPT(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💖 CMS_VERIFY_RECEIPT(3) — verify a CMS signed receipt 💖

okay so bestie, this one lives in the libcrypto library (that's the OpenSSL-ish crew, and on OpenBSD it ships in base). It's a CMS_* function, which means it's doing that fancy cryptographic message syntax thing. Don't worry, we're gonna get through it together 🫶

✨ NAME ✨

CMS_verify_receipt — verify a CMS signed receipt. That's it, that's the whole job. It checks whether a signed receipt is actually legit 🔥

🎀 SYNOPSIS 🎀

#include <openssl/cms.h>

int
CMS_verify_receipt(CMS_ContentInfo *rcms, CMS_ContentInfo *ocms,
    STACK_OF(X509) *certs, X509_STORE *store, unsigned int flags);

🦋 DESCRIPTION 🦋

So CMS_verify_receipt() verifies a CMS signed receipt. Iconic behaviour, honestly.

Here's who's who in the cast 💅

  • rcms — the signed receipt you want to verify. This is the main character of the operation 👑
  • ocms — the original SignedData structure that contains the receipt request. Like, the receipts of the receipt, iykyk 🌸
  • certs — a set of certificates to search through looking for the signing certificate. Think of it as the group chat where we go looking for who actually sent the message.
  • store — a trusted certificate store, which is what gets used for chain verification. The vibe check authority ⭐

This function behaves in a similar way to CMS_verify(3), except — and this is the important bit — the flags values CMS_DETACHED, CMS_BINARY, CMS_TEXT, and CMS_STREAM are not supported here, because they genuinely don't make sense in the context of signed receipts. Not me defending them, they just don't apply 🙈

🌈 RETURN VALUES 🌈

  • CMS_verify_receipt() returns 1 for a successful verification ✅
  • or 0 if an error occurred 💀

If it goes wrong, you can grab the error from ERR_get_error(3). That's where the lore lives.

🧚 SEE ALSO 🧚

go read those next, bestie, they're all part of the same little ecosystem 🫶

⭐ STANDARDS ⭐

RFC 2634: Enhanced Security Services for S/MIME, section 2.8: Receipt Syntax. Yes, it's got its own spec section and everything. Very official 👑

🍓 HISTORY 🍓

CMS_verify_receipt() first appeared in OpenSSL 0.9.8h and has been available since OpenBSD 6.7. So it's been around a while — a true veteran of the crypto scene 💜

and that's the whole page!! this one came from the Debian crew, dated December 20, 2025, and it's the CMS_VERIFY_RECEIPT(3) manual page — Library Functions Manual. mwah 💋 go verify some receipts, you've got this 🎀✨

📦 where this page comes from