PKCS12_SAFEBAG_CREATE_CERT(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 PKCS12_SAFEBAG_CREATE_CERT 💅

okay so this is the 3ossl girlies' guide to makin' safeBag objects — yes that's literally what they're called, and yes it's from the <openssl/pkcs12.h> era of the OpenSSL manual pages. Buckle up bestie, we're building little gift bags for certs, CRLs, secrets and keys 🎀

✨ NAME ✨

So the whole squad here — PKCS12_SAFEBAG_create_cert, PKCS12_SAFEBAG_create_crl, PKCS12_SAFEBAG_create_secret, PKCS12_SAFEBAG_create0_p8inf, PKCS12_SAFEBAG_create0_pkcs8, PKCS12_SAFEBAG_create_pkcs8_encrypt and PKCS12_SAFEBAG_create_pkcs8_encrypt_ex — are all about creating PKCS#12 safeBag objects. That's the vibe. That's the whole job. 💼

🌸 SYNOPSIS 🌸

#include <openssl/pkcs12.h>

PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_cert(X509 *x509);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_crl(X509_CRL *crl);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_secret(int type, int vtype,
                                             const unsigned char* value,
                                             int len);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create0_p8inf(PKCS8_PRIV_KEY_INFO *p8);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create0_pkcs8(X509_SIG *p8);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_pkcs8_encrypt(int pbe_nid,
                                                    const char *pass,
                                                    int passlen,
                                                    unsigned char *salt,
                                                    int saltlen, int iter,
                                                    PKCS8_PRIV_KEY_INFO *p8inf);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_pkcs8_encrypt_ex(int pbe_nid,
                                                       const char *pass,
                                                       int passlen,
                                                       unsigned char *salt,
                                                       int saltlen, int iter,
                                                       PKCS8_PRIV_KEY_INFO *p8inf,
                                                       OSSL_LIB_CTX *ctx,
                                                       const char *propq);

🦋 DESCRIPTION 🦋

Alright, one by one, no skips, no cap:

  • PKCS12_SAFEBAG_create_cert() — makes a brand-new PKCS12_SAFEBAG of type NID_certBag, and it's holding the certificate you handed it. cert bag, cert bag, cert bag 🎀
  • PKCS12_SAFEBAG_create_crl() — same energy but for revocation lists: a new PKCS12_SAFEBAG of type NID_crlBag containing the supplied crl.
  • PKCS12_SAFEBAG_create_secret() — creates a new PKCS12_SAFEBAG of the type that corresponds to a PKCS#12 secretBag. The secretBag contents get tagged as type type, with an ASN1 value of type vtype constructed using the bytes in value of length len. iykyk 🫶
  • PKCS12_SAFEBAG_create0_p8inf() — makes a new PKCS12_SAFEBAG of type NID_keyBag containing the supplied PKCS8 structure. key bag, iconic.
  • PKCS12_SAFEBAG_create0_pkcs8() — makes a new PKCS12_SAFEBAG of type NID_pkcs8ShroudedKeyBag containing the supplied PKCS8 structure. shrouded = mysterious = main character energy 💅
  • PKCS12_SAFEBAG_create_pkcs8_encrypt() — creates a new PKCS12_SAFEBAG of type NID_pkcs8ShroudedKeyBag by encrypting the supplied PKCS8 p8inf. Deets:
    • if pbe_nid is 0, a default encryption algorithm is used
    • pass is the passphrase and iter is the iteration count
    • if iter is zero then a default value of 2048 is used
    • if salt is NULL then a salt is generated randomly 🧂✨
  • PKCS12_SAFEBAG_create_pkcs8_encrypt_ex() — literally identical to PKCS12_SAFEBAG_create_pkcs8_encrypt() BUT it also lets you pass a library context ctx and a property query propq, which are used to select algorithm implementations. fancy edition 👑

🌈 NOTES 🌈

⚠️ heads up bestie: PKCS12_SAFEBAG_create_pkcs8_encrypt() makes assumptions regarding the encoding of the given pass phrase. See passphrase-encoding(7) for more information. don't come for me, come for the man page 🙈

Also, PKCS12_SAFEBAG_create_secret() was added in OpenSSL 3.0. so if you're on something ancient, that's a no from her 💀

💖 RETURN VALUES 💖

All of these functions return a valid PKCS12_SAFEBAG structure, or NULL if an error occurred. that's it. that's the tea. 😭

⭐ CONFORMING TO ⭐

IETF RFC 7292 (https://tools.ietf.org/html/rfc7292) — the standards girlies ate, no crumbs. 👑

🌸 SEE ALSO 🌸

go read those next, you're doing amazing sweetie 🫶

🎀 HISTORY 🎀

PKCS12_SAFEBAG_create_pkcs8_encrypt_ex() was added in OpenSSL 3.0. the _ex suffix really said "i'm the upgraded version" ✨

Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

k that's the whole page bestie, mwah 💋 — this was PKCS12_SAFEBAG_CREATE_CERT(3ossl) from OpenSSL 3.5.0, dated 2026-09-25. periodt. 🦋✨

📦 where this page comes from