PEM_X509_INFO_READ_BIO(3)

🌸 NAME: PEM_X509_INFO_READ_BIO(3) 🌸

okay bestie, meet PEM_X509_INFO_read_bio() — the function, and the full manual name is PEM_X509_INFO_READ_BIO(3). It’s all about PEM and DER decode of X.509 certificates, private keys, and revocation lists. 💖

---

✨ SYNOPSIS ✨

       library “libcrypto” #include <openssl/pem.h>

       STACK_OF(X509_INFO) *
       PEM_X509_INFO_read_bio(BIO *in_bp, STACK_OF(X509_INFO) *sk,
           pem_password_cb *cb, void *u);

---

💅 DESCRIPTION 💅

okay so PEM_X509_INFO_read_bio() reads zero or more objects related to X.509 certificates from in_bp, does both PEM and DER decoding, and wraps the resulting objects in newly allocated X509_INFO containers. no cap, that’s the whole vibe. ✨

Setting sk to NULL is recommended — in that case a new stack gets allocated, populated, and returned. If you pass in an existing sk, the created X509_INFO objects are pushed onto that stack. 🫶

bestie note: sk = NULL is the recommended move. 💅

For PEM decoding, PEM_read_bio(3) is used internally, which means any non-PEM data before, between, and after the objects is silently discarded. like, poof. 💨

For subsequent DER decoding, the decoding function and the field of the X509_INFO structure to store the new object in are selected according to the PEM type name. here’s the lineup 🌈:

• CERTIFICATE → decoder d2i_X509(3) → X509_INFO field certificate
• X509 CERTIFICATE → decoder d2i_X509(3) → X509_INFO field certificate
• TRUSTED CERTIFICATE → decoder d2i_X509_AUX(3) → X509_INFO field certificate
• X509 CRL → decoder d2i_X509_CRL(3) → X509_INFO field revocation list
• RSA PRIVATE KEY → decoder d2i_PrivateKey(3) → X509_INFO field private key
• DSA PRIVATE KEY → decoder d2i_PrivateKey(3) → X509_INFO field private key
• EC PRIVATE KEY → decoder d2i_PrivateKey(3) → X509_INFO field private key

Whenever the selected field is already occupied, another new X509_INFO container is allocated and pushed onto the stack. depending on the sequence of objects in the input, this can result in several partially populated X509_INFO containers being pushed onto the stack. it’s giving “one stack, many little containers.” 💀

PEM objects of types not listed in that list above are silently skipped. 🙈

Encrypted certificates and revocation lists are decrypted by calling PEM_do_header(3) internally, passing through the optional arguments cb and u. Encrypted private keys are not decrypted. Instead, the encrypted form is stored as read. All the same, PEM_get_EVP_CIPHER_INFO(3) is called internally to check that PEM headers, if there are any, are valid and specify an encryption the library is prepared to handle. 🧚

If any error occurs, objects that had already been read during the same call are deleted again and sk is left unchanged. periodt. 💅

---

🎀 RETURN VALUES 🎀

This function returns a pointer to the stack the objects read were pushed onto, or NULL if an error occurs. It fails if PEM_read_bio(3), PEM_get_EVP_CIPHER_INFO(3), PEM_do_header(3), or DER decoding fails, or if memory is exhausted. 😭

---

🔥 ERRORS 🔥

Diagnostics that can be retrieved with ERR_get_error(3), ERR_GET_REASON(3), and ERR_reason_error_string(3) include:

• ERR_R_ASN1_LIB "ASN1 lib" — DER decoding of a PEM object failed.
• ERR_R_MALLOC_FAILURE "malloc failure" — PEM_X509_INFO_read_bio() failed to allocate a new X509_INFO, STACK_OF(X509_INFO), or X509_PKEY object.

Additional types of errors can result from PEM_read_bio(3), PEM_get_EVP_CIPHER_INFO(3), and PEM_do_header(3).

After this function failed due to memory exhaustion, ERR_get_error(3) may sometimes return 0 anyway. yeah, iconic behavior. 💀

---

🌈 SEE ALSO 🌈

BIO_new(3), d2i_PrivateKey(3), d2i_X509(3), d2i_X509_CRL(3), EVP_PKEY_new(3), PEM_read(3), PEM_read_bio_PrivateKey(3), STACK_OF(3), X509_CRL_new(3), X509_INFO_new(3), X509_LOOKUP_new(3), X509_new(3)

---

🦋 HISTORY 🦋

PEM_X509_INFO_read_bio() first appeared in SSLeay 0.6.0 and has been available since OpenBSD 2.4. vintage but still main character energy. 👑

---

⭐ CAVEATS ⭐

It is not an error if the input does not contain any objects of the desired types. In that case, nothing is added to sk, or if sk is NULL, a newly allocated, empty stack is returned. The only way to detect this situation is by comparing the number of objects on the stack before and after the call. lowkey sneaky, but that’s the rule. 🫶

---

💜 BUGS 💜

When reaching the end of the input, this function calls ERR_clear_error(3), which may hide errors that occurred before calling it. not me pointing at the error-hiding behavior 😭

---

xoxo, your Debian bestie 💅 — source/version: Debian; date: July 17, 2025; manual: PEM_X509_INFO_READ_BIO(3).