PKCS12_SAFEBAG_GET1_CERT(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 PKCS12_SAFEBAG_GET1_CERT(3ossl) 🎀

okay so this is a whole family of getters from OpenSSL's pkcs12.h — like, the 3ossl manual section, bestie, we're in the big leagues now. Buckle up. 🦋

✨ NAME ✨

Bestie, this is a whole squad of functions, and every single one of them is here to pull objects out of a PKCS#12 safeBag. The lineup:

  • PKCS12_SAFEBAG_get0_attr
  • PKCS12_SAFEBAG_get0_type
  • PKCS12_SAFEBAG_get_nid
  • PKCS12_SAFEBAG_get_bag_nid
  • PKCS12_SAFEBAG_get0_bag_obj
  • PKCS12_SAFEBAG_get0_bag_type
  • PKCS12_SAFEBAG_get1_cert_ex
  • PKCS12_SAFEBAG_get1_cert
  • PKCS12_SAFEBAG_get1_crl_ex
  • PKCS12_SAFEBAG_get1_crl
  • PKCS12_SAFEBAG_get0_safes
  • PKCS12_SAFEBAG_get0_p8inf
  • PKCS12_SAFEBAG_get0_pkcs8

and their collective whole vibe is: get objects from a PKCS#12 safeBag. periodt. 👑

🌸 SYNOPSIS 🌸

#include <openssl/pkcs12.h>

const ASN1_TYPE *PKCS12_SAFEBAG_get0_attr(const PKCS12_SAFEBAG *bag,
                                          int attr_nid);
const ASN1_OBJECT *PKCS12_SAFEBAG_get0_type(const PKCS12_SAFEBAG *bag);
int PKCS12_SAFEBAG_get_nid(const PKCS12_SAFEBAG *bag);
int PKCS12_SAFEBAG_get_bag_nid(const PKCS12_SAFEBAG *bag);
const ASN1_TYPE *PKCS12_SAFEBAG_get0_bag_obj(const PKCS12_SAFEBAG *bag);
const ASN1_OBJECT *PKCS12_SAFEBAG_get0_bag_type(const PKCS12_SAFEBAG *bag);
X509_CRL *PKCS12_SAFEBAG_get1_cert_ex(const PKCS12_SAFEBAG *bag,
                                      OSSL_LIB_CTX *libctx, const char *propq);
X509 *PKCS12_SAFEBAG_get1_cert(const PKCS12_SAFEBAG *bag);
X509_CRL *PKCS12_SAFEBAG_get1_crl_ex(const PKCS12_SAFEBAG *bag,
                                     OSSL_LIB_CTX *libctx, const char *propq);
X509_CRL *PKCS12_SAFEBAG_get1_crl(const PKCS12_SAFEBAG *bag);
const STACK_OF(PKCS12_SAFEBAG) *PKCS12_SAFEBAG_get0_safes(const PKCS12_SAFEBAG *bag);
const PKCS8_PRIV_KEY_INFO *PKCS12_SAFEBAG_get0_p8inf(const PKCS12_SAFEBAG *bag);
const X509_SIG *PKCS12_SAFEBAG_get0_pkcs8(const PKCS12_SAFEBAG *bag);

look at all those signatures, literally gorgeous 😭 copy them exactly, no cap, they're case-sensitive and the consts are load-bearing.

🧚 DESCRIPTION 🧚

okay so let's go through these one at a time, group-chat style, because there are a lot of them and every single one matters:

  • PKCS12_SAFEBAG_get0_attr() — grabs the attribute value that matches attr_nid. that's it. that's the whole function. slay. 💅
  • PKCS12_SAFEBAG_get0_type() — hands you the safeBag type, but as an OID.
  • PKCS12_SAFEBAG_get_nid() — same idea, but the safeBag type comes back as an NID instead. and that NID could be NID_certBag, NID_crlBag, NID_keyBag, NID_secretBag, NID_safeContentsBag or NID_pkcs8ShroudedKeyBag. iconic little enum family, love them. 🫶
  • PKCS12_SAFEBAG_get_bag_nid() — this one gets the type of the object contained within the PKCS12_SAFEBAG. subtle difference, bestie: this corresponds to the bag type for most bags, but it can be arbitrary for secretBags. so don't go assuming. 🙈
  • PKCS12_SAFEBAG_get0_bag_type() — takes that same type and gives it to you as an OID.
  • PKCS12_SAFEBAG_get0_bag_obj() — retrieves the object contained within the safeBag. the actual goods. 📦
  • PKCS12_SAFEBAG_get1_cert_ex() and PKCS12_SAFEBAG_get1_crl_ex() — these return brand-new X509 or X509_CRL objects (yes, new — the "1" in the name is doing real work) from the item in the safeBag. the libctx and propq params get used when fetching algorithms, and you can optionally set them to NULL.
  • PKCS12_SAFEBAG_get1_cert() and PKCS12_SAFEBAG_get1_crl() — literally the same as PKCS12_SAFEBAG_get1_cert_ex() and PKCS12_SAFEBAG_get1_crl_ex(), except they set the libctx and prop to NULL. which means: this will use the default library context. 🏠
  • PKCS12_SAFEBAG_get0_p8inf() and PKCS12_SAFEBAG_get0_pkcs8() — return the PKCS8 object from a PKCS8shroudedKeyBag or a keyBag.
  • PKCS12_SAFEBAG_get0_safes() — retrieves the set of safeBags contained within a safeContentsBag. bags inside bags, it's giving inception 🎀

🔥 RETURN VALUES 🔥

  • PKCS12_SAFEBAG_get_nid() and PKCS12_SAFEBAG_get_bag_nid() return the NID of the safeBag or bag object — or -1 if there is no corresponding NID. so like, check for the -1, bestie, don't just vibe-check it and move on. 💀
  • other functions return a valid object of the specified type, or NULL if an error occurred.
ngl, -1 for the int-returning ones and NULL for everything else — memorize that split, it's the whole plot twist.

⭐ SEE ALSO ⭐

go read these next, they're the linked lore:

🦋 HISTORY 🦋

  • PKCS12_SAFEBAG_get1_cert_ex() and PKCS12_SAFEBAG_get1_crl_ex() were added in OpenSSL 3.2. newcomers, but already main character energy. 👑

Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

that's the whole page, bestie 🫶 — and for the record, this little masterpiece is from OpenSSL 3.5.0, dated 2026-09-25, filed under PKCS12_SAFEBAG_GET1_CERT(3ossl). go forth and get those safeBag objects 💖✨🎀

📦 where this page comes from