SMIME_WRITE_CMS(3)

💌 SMIME_WRITE_CMS 💌

okay so bestie, welcome to SMIME_write_CMS — the libcrypto girlie whose whole job is converting a CMS structure into S/MIME format. yes that's the NAME, and yes she's iconic for it ✨

---

✨ SYNOPSIS ✨

library “libcrypto” #include <openssl/cms.h>

int
SMIME_write_CMS(BIO *out, CMS_ContentInfo *cms, BIO *data, int flags);

---

🎀 DESCRIPTION 🎀

So SMIME_write_CMS() generates an S/MIME message on out by writing MIME 1.0 headers, and then — right after, no gap — a BER- and base64-encoded serialization of cms. The BER encoding uses the DER format, except for the cases described down in CMS_STREAM below. And if streaming is enabled, the content has to be supplied in the data argument. no cap, that's the deal 💅

The flags can be the logical OR of zero or more of the following bits:

🌈 the flags

• CMS_DETACHED — use cleartext signing and generate a "multipart/signed" S/MIME message. The content gets read from data. If data is a NULL pointer, this flag is ignored, like it said nothing and walked away 🙈
  • This flag is only supported if cms is of the type SignedData and CMS_DETACHED was also set when it was created with CMS_sign(3).
  • If CMS_STREAM is not set, the data must be read twice: once to compute the signature in CMS_sign(3) and once to output the S/MIME message. yeah, twice. she's thorough 😭
  • If CMS_DETACHED is ignored or not specified, the smime-type is chosen according to CMS_get0_type(3):
    • NID_pkcs7_enveloped → "enveloped-data"
    • NID_pkcs7_signed:
      • "signed-receipt" if CMS_get0_eContentType(3) is NID_id_smime_ct_receipt
      • "signed-data" if cms specifies any digest algorithm
      • "certs-only" otherwise
    • NID_id_smime_ct_compressedData → "compressed-data"
• CMS_REUSE_DIGEST — skip the calls to CMS_dataInit(3) and CMS_dataFinal(3). This flag has no effect unless CMS_DETACHED is also set. fr fr, it does nothing on its own 🫶
• CMS_STREAM — perform streaming by reading the content from data. This only works if CMS_DETACHED is not specified.
  • This flag should only be set if CMS_STREAM was also passed to the function that created cms. iykyk 🧚
  • The content is output in BER format using indefinite length constructed encoding, except in the case of SignedData with detached content — where the content is absent and DER format is used.
• CMS_TEXT — prepend the line "Content-Type: text/plain" to the content. This only makes sense if CMS_DETACHED is also set. It is ignored if the flag SMIME_BINARY is also set. conflicting vibes, honestly 💀
• SMIME_BINARY — if specified, this flag is passed through to SMIME_crlf_copy(3). that's it, that's the whole job 🌸
• SMIME_CRLFEOL — end MIME header lines with pairs of carriage return and newline characters. By default, no carriage return characters are written and header lines are ended with newline characters only. Windows girlies stay winning 👑

---

🦋 RETURN VALUES 🦋

SMIME_write_CMS() is intended to return 1 on success or 0 on failure. "intended" doing olympic-level heavy lifting there, bestie — see the BUGS section, it's giving foreshadowing 😭

---

🔥 SEE ALSO 🔥

BIO_f_base64(3), BIO_new(3), CMS_ContentInfo_new(3), CMS_encrypt(3), CMS_sign(3), d2i_CMS_ContentInfo(3), ERR_get_error(3), SMIME_crlf_copy(3), SMIME_read_CMS(3), SMIME_write_PKCS7(3)

the whole friend group, honestly 🫶

---

👑 HISTORY 👑

SMIME_write_CMS() first appeared in OpenSSL 0.9.8h and has been available since OpenBSD 6.7. a true legacy icon, she's been slaying since forever ⭐

---

💀 BUGS 💀

• SMIME_write_CMS() ignores most errors and is likely to return 1 even after producing corrupt or incomplete output. so like… she'll tell you she ate, but did she actually eat? questionable. don't trust the return value blindly 🙈
• SMIME_write_CMS() always base64 encodes CMS structures. There should be an option to disable this. no option yet, so we wait 🎀

---

warning bestie: that first bug is real — corrupt or incomplete output can still come back with a 1, so verify your output yourself. not me trusting the honor system 😭

---

okay that's the whole page, periodt 💖 this was SMIME_write_CMS from the Debian build of the manual, dated June 11, 2025 — written up with love, butterflies, and a healthy distrust of return values 🦋💜