ESS_SIGNING_CERT_NEW(3)

💖 NAME 💖

okay so bestie, this is the whole group-chat vibe for ESS_SIGNING_CERT_new(3) and its besties — ESS_SIGNING_CERT_free, ESS_CERT_ID_new, ESS_CERT_ID_free, ESS_ISSUER_SERIAL_new, and ESS_ISSUER_SERIAL_free — aka signing certificates for S/MIME, periodt 💅. this page is from the Library Functions Manual, and we are about to make ASN.1 signing-cert stuff make sense, iykyk ✨.

---

✨ SYNOPSIS ✨

first up, the library + header situation, exactly as it appears:

library “libcrypto” #include <openssl/ts.h>

then the function prototypes, no cap:

ESS_SIGNING_CERT *
ESS_SIGNING_CERT_new(void);

void
ESS_SIGNING_CERT_free(ESS_SIGNING_CERT *signing_cert);

ESS_CERT_ID *
ESS_CERT_ID_new(void);

void
ESS_CERT_ID_free(ESS_CERT_ID *cert_id);

ESS_ISSUER_SERIAL *
ESS_ISSUER_SERIAL_new(void);

void
ESS_ISSUER_SERIAL_free(ESS_ISSUER_SERIAL *issuer_serial);

---

🎀 DESCRIPTION 🎀

the signing certificate may be included in the signedAttributes field of a SignerInfo structure to mitigate simple substitution and re-issue attacks. security slay 🛡️✨

• ESS_SIGNING_CERT_new() — allocates and initializes an empty ESS_SIGNING_CERT object, representing an ASN.1 SigningCertificate structure defined in RFC 2634 section 5.4. it can hold the certificate used for signing the data, additional authorization certificates that can be used during validation, and policies applying to the certificate. ESS_SIGNING_CERT_free() frees signing_cert.
• ESS_CERT_ID_new() — allocates and initializes an empty ESS_CERT_ID object, representing an ASN.1 ESSCertID structure defined in RFC 2634 section 5.4.1. such objects can be used inside ESS_SIGNING_CERT objects, and each one can hold a SHA1 hash of one certificate. ESS_CERT_ID_free() frees cert_id.
• ESS_ISSUER_SERIAL_new() — allocates and initializes an empty ESS_ISSUER_SERIAL object, representing an ASN.1 IssuerSerial structure defined in RFC 2634 section 5.4.1. it can hold an issuer name and a serial number and can be included in an ESS_CERT_ID object, which is useful for additional authorization certificates, but redundant for the signing certificate itself. ESS_ISSUER_SERIAL_free() frees issuer_serial.

---

🌈 RETURN VALUES 🌈

ESS_SIGNING_CERT_new(), ESS_CERT_ID_new(), and ESS_ISSUER_SERIAL_new() return the new ESS_SIGNING_CERT, ESS_CERT_ID, or ESS_ISSUER_SERIAL object, respectively, or NULL if an error occurred. so if you get NULL, that is the error vibe 😭.

---

🦋 SEE ALSO 🦋

• d2i_ESS_SIGNING_CERT(3)

go read that one next, bestie 👀💖

---

👑 STANDARDS 👑

• RFC 2634: Enhanced Security Services for S/MIME, section 5: Signing Certificate Attribute
• note that RFC 2634 has been updated by RFC 5035: Enhanced Security Services (ESS) Update: Adding CertID Algorithm Agility. but the current implementation only supports the Signing Certificate Attribute Definition Version 1 according to RFC 2634, not the Signing Certificate Attribute Definition Version 2 according to RFC 5035.

---

🧚 HISTORY 🧚

these functions first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9.

---

okay that is the whole page, bestie 💖 — this one is from Debian, dated June 8, 2025, and it is the manual page for ESS_SIGNING_CERT_NEW(3). go forth and sign those certificates, mwah 💋✨