SMIME_READ_PKCS7(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💌 SMIME_READ_PKCS7(3) — like, the whole page, bestie

Okay so this one lives in the Library Functions Manual (yes that's the manual name, we're being fancy today ✨) and it's all about pulling a PKCS#7 object out of an S/MIME message. Sit down, get comfy, we're doing crypto 💅

🌸 SYNOPSIS 🌸

First things first, you gotta be linking against libcrypto and pulling in the header:

library “libcrypto” #include <openssl/pkcs7.h>

PKCS7 *
SMIME_read_PKCS7(BIO *in, BIO **bcont);

That's the whole vibe. One function, two args, one PKCS7 * coming back at you 🫶

✨ DESCRIPTION ✨

So SMIME_read_PKCS7() parses a message that's in S/MIME format. That's it, that's the job. 💖

in is the BIO you read the message from — literally just "where's the message at".

Now here's the fun part, the little plot twist 🌈: if cleartext signing is being used, then the content gets saved into a memory BIO, and that memory BIO gets written to *bcont. If cleartext signing is not the move, then *bcont is just set to NULL. Simple as that.

The parsed PKCS#7 structure is what you get back — or NULL if something went wrong 😭.

And if *bcont is not NULL? That means the message is clear text signed, bestie 👑. In that case you can hand *bcont straight to PKCS7_verify(3) with the PKCS7_DETACHED flag set. Iconic.

If it is NULL, then you figure out what type of structure you're holding using the PKCS7_type_is_*() macros that live in <openssl/pkcs7.h>. They're right there, go check 'em.

🧚 Future-proofing moment: to support future functionality, if bcont is not NULL, you should initialize *bcont to NULL. Not a suggestion, it's the vibe check. Example time:
BIO *cont = NULL;
PKCS7 *p7;

p7 = SMIME_read_PKCS7(in, &cont);

Look at that. Beautiful. Zero notes. ⭐

🎀 RETURN VALUES 🎀

SMIME_read_PKCS7() returns a valid PKCS7 structure, or NULL if an error occurred 💀. And if it is NULL and you're sitting there like "but why", the error can be obtained from ERR_get_error(3). Go get the tea, it's all in there 🍓

🦋 SEE ALSO 🦋

Go touch these, they're all related and they all slay in their own way:

👑 HISTORY 👑

SMIME_read_PKCS7() first appeared in OpenSSL 0.9.5 and has been available since OpenBSD 2.7. She's a legacy icon, she's been here longer than most of us, periodt 💅

💀 BUGS 💀

Okay so ngl, there are some things you need to know. Not to be dramatic but these matter:

  • The MIME parser that SMIME_read_PKCS7() uses is somewhat primitive 😭. It'll handle most S/MIME messages, sure, but more complex compound formats may just... not work. It's giving "does her best".
  • The parser assumes the PKCS7 structure is always base64 encoded. So if it's in binary format, or it uses quoted printable format? Yeah, it will not handle that case. Not even a little. 🙈
  • The use of a memory BIO to hold the signed content limits the size of the message which can be processed, because of memory restraints. A streaming single pass option should be available — but, you know, it isn't. Big sigh. 💀
🌸 For real though, keep those in mind before you go pointing this at something enormous or weirdly encoded. Protect your peace.

💖 That's the page, bestie! 💖

This one came from Debian, dated June 11, 2025 — so thank the Debian crew, go read your ERR_get_error(3), and don't forget to init your *bcont to NULL. Mwah 🫶✨🎀

📦 where this page comes from