PKCS12_NEWPASS(3)

💖 PKCS12_NEWPASS(3) 💖

okay so bestie, this one lives in the Library Functions Manual section (the (3) girlies, you know the vibe), and it's all about swapping out a password on a PKCS#12 blob. lowkey iconic utility behavior ngl.

---

✨ NAME ✨

PKCS12_newpass — change the password of a PKCS#12 structure 💅

---

🎀 SYNOPSIS 🎀

library “libcrypto” #include <openssl/pkcs12.h>

int
PKCS12_newpass(PKCS12 *p12, const char *oldpass, const char *newpass);

---

🦋 DESCRIPTION 🦋

So PKCS12_newpass() changes the password of a PKCS#12 structure. that's it, that's the job, and it ate.

Here's the cast of characters:

• p12 is a pointer to a PKCS#12 structure — your main character.
• oldpass is the existing password (the one you're breaking up with).
• newpass is the new password (the glow-up).

Now listen, this part matters: if the PKCS#12 structure does not have a password, use the empty string "" for oldpass. do not try to be cute and pass NULL for oldpass — passing NULL for oldpass results in a PKCS12_newpass() failure. it's giving "tried it, didn't work." 🙈

And if you use the wrong password for oldpass, the function will fail with a MAC verification error. caught in 4K. 😭

In rare cases, the PKCS#12 structure does not contain a MAC — in this case it will usually fail with a decryption padding error. so if you see padding slander instead of MAC slander, that's why. iykyk.

---

💀 RETURN VALUES 💀

Upon successful completion, 1 is returned. slay! ✨ otherwise 0 is returned, and you can retrieve an error code with ERR_get_error(3). go read the receipts bestie, the info is right there.

not the 0 return... when it comes back 0 you literally have to go check ERR_get_error(3) or you're just guessing. no cap.

---

🌸 EXAMPLES 🌸

This example loads a PKCS#12 file, changes its password, and writes out the result to a new file. honestly? a whole little journey. 🫶

#include <stdio.h>
#include <stdlib.h>
#include <openssl/pem.h>
#include <openssl/err.h>
#include <openssl/pkcs12.h>

int main(int argc, char **argv)
{
        FILE *fp;
        PKCS12 *p12;
        if (argc != 5) {
                fprintf(stderr,
                    "Usage: pkread p12file password newpass opfile\n");
                return 1;
        }
        if ((fp = fopen(argv[1], "rb")) == NULL) {
                fprintf(stderr, "Error opening file %s\n", argv[1]);
                return 1;
        }
        p12 = d2i_PKCS12_fp(fp, NULL);
        fclose(fp);
        if (p12 == NULL) {
                fprintf(stderr, "Error reading PKCS#12 file\n");
                ERR_print_errors_fp(stderr);
                return 1;
        }
        if (PKCS12_newpass(p12, argv[2], argv[3]) == 0) {
                fprintf(stderr, "Error changing password\n");
                ERR_print_errors_fp(stderr);
                PKCS12_free(p12);
                return 1;
        }
        if ((fp = fopen(argv[4], "wb")) == NULL) {
                fprintf(stderr, "Error opening file %s\n", argv[4]);
                PKCS12_free(p12);
                return 1;
        }
        i2d_PKCS12_fp(fp, p12);
        PKCS12_free(p12);
        fclose(fp);
        return 0;
}

the usage line is Usage: pkread p12file password newpass opfile — four args, argc != 5, don't come for me, the math is mathing. 💅

---

👑 SEE ALSO 👑

• PKCS12_create(3)
• PKCS12_new(3)

the friend group!! go say hi!! 🌈

---

⭐ HISTORY ⭐

PKCS12_newpass() first appeared in OpenSSL 0.9.5 and has been available since OpenBSD 2.7. she's a legacy icon and she's been booked and busy since forever fr fr. 👑

---

🔥 BUGS 🔥

okay so this is the part where we get real. 🙈

The password format is a NUL terminated ASCII string which is converted to Unicode form internally. As a result, some passwords cannot be supplied to this function.

like... the function just cannot take your password. it's not you, it's the NUL terminated ASCII → Unicode conversion. 💀 no workaround listed here, so just know the limit exists.

---

and that's the whole page bestie!! written by the Debian girlies, dated June 8, 2025, under the PKCS12_NEWPASS(3) era 💜✨ stay encrypted, stay hydrated, mwah 🎀