PKCS12_ADD_SAFE(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💖 PKCS12_ADD_SAFE(3ossl) 💖

okay bestie, buckle up 💅 this is an OpenSSL manual page and honestly it's giving "glue code that holds your whole .p12 together" energy. It's all about PKCS12_add_safe, PKCS12_add_safe_ex, PKCS12_add_safes and PKCS12_add_safes_ex — the little functions that create and add objects to a PKCS#12 structure 🎀

✨ SYNOPSIS ✨

#include <openssl/pkcs12.h>

int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags,
                    int safe_nid, int iter, const char *pass);
int PKCS12_add_safe_ex(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags,
                       int safe_nid, int iter, const char *pass,
                       OSSL_LIB_CTX *ctx, const char *propq);

PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int p7_nid);
PKCS12 *PKCS12_add_safes_ex(STACK_OF(PKCS7) *safes, int p7_nid,
                            OSSL_LIB_CTX *ctx, const char *propq);

🌸 DESCRIPTION 🌸

so PKCS12_add_safe() is the main character here 👑 — it creates a new PKCS7 contentInfo containing the PKCS12_SAFEBAGs you handed it, and adds that to a set of PKCS7 contentInfos. The type of that contentInfo is fully up to safe_nid, and the vibe check goes like this:

  • if safe_nid is -1, you get a plain PKCS7 data contentInfo, no encryption, just vibes 🦋
  • if safe_nid is a valid PBE algorithm NID, you get a PKCS7 encryptedData contentInfo. The algorithm takes pass as the passphrase and iter as the iteration count. and like, if iter is zero, a default iteration count of 2048 gets used instead — slay, defaults 🔥
  • if safe_nid is 0, you get a PKCS7 encryptedData contentInfo using a default encryption algorithm, which currently is NID_pbe_WithSHA1And3_Key_TripleDES_CBC 💜

PKCS12_add_safe_ex() is literally identical to PKCS12_add_safe() bestie, except it also lets you pass a library context ctx and a property query propq so you can pick which algorithm implementations get used 🧚

then we have PKCS12_add_safes() — this one creates a PKCS12 structure containing the supplied set of PKCS7 contentInfos. The safes get enclosed first inside a PKCS7 contentInfo of type p7_nid. and ngl, currently the only supported type is NID_pkcs7_data 🙈 so don't get too creative.

PKCS12_add_safes_ex() is the exact same deal as PKCS12_add_safes(), but again with that library context ctx and property query propq for selecting algorithm implementations ✨

🫶 NOTES 🫶

heads up: PKCS12_add_safe() makes assumptions about the encoding of the pass phrase you give it 😭 it's not out here reading minds. Go check passphrase-encoding(7) for the whole story, iykyk.

⭐ RETURN VALUES ⭐

  • PKCS12_add_safe() returns 1 to say success, or 0 for failure 💀
  • PKCS12_add_safes() returns a valid PKCS12 structure, or NULL if an error happened 😭

🌈 CONFORMING TO 🌈

IETF RFC 7292 (https://tools.ietf.org/html/rfc7292) — yes, the actual spec, go read it if you're that kind of girl 🎀

🦋 SEE ALSO 🦋

👑 HISTORY 👑

PKCS12_add_safe_ex() and PKCS12_add_safes_ex() were added in OpenSSL 3.0 — the _ex girlies are relatively new, periodt 💅

Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

and that's the whole page bestie 🫶 mwah 💋 — brought to you by 3.5.0, dated 2026-09-25, from the PKCS12_ADD_SAFE(3ossl) girlies themselves 🌸✨

📦 where this page comes from