D2I_PKCS12(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💅 D2I_PKCS12(3) — the libcrypto glow-up

okay so bestie, welcome to the D2I_PKCS12(3) page, straight out of the Library Functions Manual, and no, that title is not a typo, it's just how the C kids name things 🎀

✨ NAME ✨

d2i_PKCS12, i2d_PKCS12, d2i_PKCS12_bio, i2d_PKCS12_bio, d2i_PKCS12_fp, i2d_PKCS12_fp, d2i_PKCS12_MAC_DATA, i2d_PKCS12_MAC_DATA, d2i_PKCS12_SAFEBAG, i2d_PKCS12_SAFEBAG, d2i_PKCS12_BAGS, i2d_PKCS12_BAGS — decode and encode PKCS#12 structures 🦋

(like, yes, that's twelve functions and no, I'm not going to pretend that's a normal amount of functions. it's giving "one family, twelve siblings, all iconic.")

🌸 SYNOPSIS 🌸

first up: library “libcrypto” and #include <openssl/pkcs12.h> — the lil duo that makes all of this work 💖

PKCS12 *
d2i_PKCS12(PKCS12 **val_out, const unsigned char **der_in, long length);

int
i2d_PKCS12(PKCS12 *val_in, unsigned char **der_out);

PKCS12 *
d2i_PKCS12_bio(BIO *in_bio, PKCS12 **val_out);

int
i2d_PKCS12_bio(BIO *out_bio, PKCS12 *val_in);

PKCS12 *
d2i_PKCS12_fp(FILE *in_fp, PKCS12 **val_out);

int
i2d_PKCS12_fp(FILE *out_fp, PKCS12 *val_in);

PKCS12_MAC_DATA *
d2i_PKCS12_MAC_DATA(PKCS12_MAC_DATA **val_out,
    const unsigned char **der_in, long length);

int
i2d_PKCS12_MAC_DATA(PKCS12_MAC_DATA *val_in, unsigned char **der_out);

PKCS12_SAFEBAG *
d2i_PKCS12_SAFEBAG(PKCS12_SAFEBAG **val_out,
    const unsigned char **der_in, long length);

int
i2d_PKCS12_SAFEBAG(PKCS12_SAFEBAG *val_in, unsigned char **der_out);

PKCS12_BAGS *
d2i_PKCS12_BAGS(PKCS12_BAGS **val_out, const unsigned char **der_in,
    long length);

int
i2d_PKCS12_BAGS(PKCS12_BAGS *val_in, unsigned char **der_out);

look at all those signatures. main character energy fr fr 👑

💜 DESCRIPTION 💜

okay so the big picture: these functions decode and encode PKCS#12 structures. for the juicy details on semantics, examples, caveats, and bugs, go read ASN1_item_d2i(3) — that's the parent page, the lore, the iykyk 🫶

  • d2i_PKCS12() and i2d_PKCS12() — decode and encode an ASN.1 PFX (personal information exchange) structure, defined in RFC 7292 section 4. yes, "personal information exchange" — it's literally in the name, it's a whole vibe 🌈
  • d2i_PKCS12_bio(), i2d_PKCS12_bio(), d2i_PKCS12_fp(), and i2d_PKCS12_fp() — same deal, except they decode or encode using a BIO or a FILE pointer. same energy, different plumbing 🧚
  • d2i_PKCS12_MAC_DATA() and i2d_PKCS12_MAC_DATA() — decode and encode an ASN.1 MacData structure, defined in RFC 7292 section 4 💅
  • d2i_PKCS12_SAFEBAG() and i2d_PKCS12_SAFEBAG() — decode and encode an ASN.1 SafeBag structure, defined in RFC 7292 section 4.2 🎀
  • d2i_PKCS12_BAGS() and i2d_PKCS12_BAGS() — decode and encode the bagValue field of an ASN.1 SafeBag structure ⭐

(the naming convention is d2i = "DER to internal" and i2d = "internal to DER", so yeah, you already knew that, you're so smart 💖)

🔥 RETURN VALUES 🔥

pay attention bestie, because the returns are not all the same and that's exactly the kind of thing that bites you at 2am 😭

  • d2i_PKCS12(), d2i_PKCS12_bio(), and d2i_PKCS12_fp() — return a PKCS12 object, or NULL if an error occurs 💀
  • d2i_PKCS12_MAC_DATA(), d2i_PKCS12_SAFEBAG(), and d2i_PKCS12_BAGS() — return a PKCS12_MAC_DATA, PKCS12_SAFEBAG, or PKCS12_BAGS object, respectively, or NULL if an error occurs 🙈
  • i2d_PKCS12(), i2d_PKCS12_MAC_DATA(), i2d_PKCS12_SAFEBAG(), and i2d_PKCS12_BAGS() — return the number of bytes successfully encoded, or a negative value if an error occurs. yes, negative. not zero. don't check == 0, check < 0, I'm begging 🫠
  • i2d_PKCS12_bio() and i2d_PKCS12_fp() — return 1 for success or 0 if an error occurs. classic. iconic. extremely int-coded ✨
ngl the mix of "returns NULL", "returns negative", and "returns 1 or 0" is a vibe check you have to pass every single time. no cap. 🚨

🦋 SEE ALSO 🦋

go read these next, they're literally the friends of this page:

🌟 STANDARDS 🌟

RFC 7292: PKCS #12: Personal Information Exchange Syntax — that's the whole standard, that's the source material, that's the blueprint 👑

🌈 HISTORY 🌈

d2i_PKCS12(), i2d_PKCS12(), d2i_PKCS12_bio(), i2d_PKCS12_bio(), d2i_PKCS12_fp(), i2d_PKCS12_fp(), d2i_PKCS12_MAC_DATA(), i2d_PKCS12_MAC_DATA(), d2i_PKCS12_SAFEBAG(), i2d_PKCS12_SAFEBAG(), d2i_PKCS12_BAGS(), and i2d_PKCS12_BAGS() first appeared in OpenSSL 0.9.3 and have been available since OpenBSD 2.6 🧚‍♀️

(so they've been doing this since before most of us could read. legends only. 💜)

and that's the page! sourced from the Debian build, dated June 8, 2025, landing in your group chat like a little gift 🎁 slay, bye, go encode something responsibly 💅✨

📦 where this page comes from