D2I_X509_SIG(3)

💅 D2I_X509_SIG — decode and encode PKCS#7 digest information 🎀

okay so bestie, this is a page from the libcrypto manual (that's the OpenSSL-ish crypto library, iykyk) and it's all about turning DER bytes into X509_SIG objects and back again. Six functions, two directions, three flavours of input/output. Let's get into it ✨

---

🌸 SYNOPSIS 🌸

Like, here's the whole squad, and yes you do need #include <openssl/x509.h> and to link libcrypto:

library “libcrypto” #include <openssl/x509.h>

X509_SIG *
d2i_X509_SIG(X509_SIG **val_out, const unsigned char **der_in,
    long length);

int
i2d_X509_SIG(X509_SIG *val_in, unsigned char **der_out);

X509_SIG *
d2i_PKCS8_bio(BIO *in_bio, X509_SIG **val_out);

int
i2d_PKCS8_bio(BIO *out_bio, X509_SIG *val_in);

X509_SIG *
d2i_PKCS8_fp(FILE *in_fp, X509_SIG **val_out);

int
i2d_PKCS8_fp(FILE *out_fp, X509_SIG *val_in);

---

🦋 DESCRIPTION 🦋

So d2i_X509_SIG() and i2d_X509_SIG() are the OGs — they decode and encode an ASN.1 DigestInfo structure, which is defined in RFC 2315 section 9.4 and, equivalently, in RFC 8017 section 9.2. 💖

For all the juicy details about semantics, examples, caveats and bugs, go read ASN1_item_d2i(3). This page is literally just a friendly face on top of that.

Then we've got the variants, because sometimes you're working with streams and not raw byte buffers:

• d2i_PKCS8_bio() and d2i_PKCS8_fp() — same energy as d2i_X509_SIG(), except they read from a BIO or a FILE pointer respectively. 🫶
• i2d_PKCS8_bio() and i2d_PKCS8_fp() — same energy as i2d_X509_SIG(), except they write to a BIO or a FILE pointer respectively. ✨

---

⭐ RETURN VALUES ⭐

• d2i_X509_SIG(), d2i_PKCS8_bio(), and d2i_PKCS8_fp() return an X509_SIG object, or NULL if an error occurs. 😭
• i2d_X509_SIG() returns the number of bytes successfully encoded, or a negative value if an error occurs.
• i2d_PKCS8_bio() and i2d_PKCS8_fp() return 1 for success or 0 if an error occurs. (yes, just 1 and 0, don't @ me)

---

🔥 SEE ALSO 🔥

ASN1_item_d2i(3), PKCS7_new(3), RSA_sign(3), X509_SIG_new(3) — go read these next, bestie, they're the whole lore.

---

👑 STANDARDS 👑

• RFC 2315: PKCS #7: Cryptographic Message Syntax, section 9: Signed-data content type
• RFC 8017: PKCS #1: RSA Cryptography Specifications, section 9: Encoding Methods for Signatures

---

🌈 HISTORY 🌈

d2i_X509_SIG() and i2d_X509_SIG() first appeared in SSLeay 0.5.1 and have been available since OpenBSD 2.4. vintage 💅

d2i_PKCS8_bio(), i2d_PKCS8_bio(), d2i_PKCS8_fp(), and i2d_PKCS8_fp() first appeared in OpenSSL 0.9.4 and have been available since OpenBSD 2.6. also vintage.

---

💀 BUGS 💀

okay so this is the part where the manpage gets real with us:

• d2i_PKCS8_bio(), i2d_PKCS8_bio(), d2i_PKCS8_fp(), and i2d_PKCS8_fp() are severely misnamed and should have been called “d2i_X509_SIG_bio” and so on. like, not even close. 🙈
• Or arguably, the X509_SIG object is misnamed itself, considering that it represents DigestInfo from PKCS#7 and PKCS#1. Then again, calling it “PKCS8” instead clearly isn't an improvement. 😭
• Either way, these names just don't fit. periodt.

---

Debian, August 25, 2026 — that's the version and date stamp, and honestly? iconic. thanks for reading, bestie, go forth and encode responsibly 🧚💜