PKCS7_SIGN_ADD_SIGNER(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 PKCS7_SIGN_ADD_SIGNER (3ossl) — the OpenSSL glow-up edition

okay so bestie, we're in the OpenSSL manual pages, section 3ossl, and today's main character is PKCS7_SIGN_ADD_SIGNER. pull up a chair, this one's all about adding stuff to a PKCS7 structure. ✨

🎀 NAME

PKCS7_sign_add_signer, PKCS7_add_certificate, PKCS7_add_crl — literally just adding information to a PKCS7 structure. that's the whole vibe. 🫶

🌸 SYNOPSIS

#include <openssl/pkcs7.h>

PKCS7_SIGNER_INFO *PKCS7_sign_add_signer(PKCS7 *p7, X509 *signcert,
                                         EVP_PKEY *pkey, const EVP_MD *md, int flags);
int PKCS7_add_certificate(PKCS7 *p7, X509 *cert);
int PKCS7_add_crl(PKCS7 *p7, X509_CRL *crl);

💖 DESCRIPTION

so PKCS7_sign_add_signer() does exactly what it says on the tin: it adds a signer to a PKCS7 signed data structure p7. that signer comes with a certificate signcert, a private key pkey, and a message digest md. icon behaviour, no notes. 💅

now, where do you even get this PKCS7 structure? you get it from an initial call to PKCS7_sign() with the PKCS7_PARTIAL flag set — or, in the case of re-signing, from a valid PKCS#7 signed data structure. that's the plug, bestie. 🔌

if md is NULL? no stress — the default digest for the public key algorithm gets used instead. main character energy from the library tbh.

🫶 important though: unless the PKCS7_REUSE_DIGEST flag is set, the returned PKCS7 structure is not complete and must be finalized — either by streaming (if that applies to you) or by calling PKCS7_final(). don't forget, or it's giving unfinished homework.

✨ NOTES

the whole reason this function exists is to give you finer control over a PKCS#7 signed data structure when the simpler PKCS7_sign() defaults just aren't it. like, say you need multiple signers, or non-default digest algorithms. that's your moment. 🔥

any of the following flags (ored together, bestie — stack 'em) can be passed in the flags parameter:

  • PKCS7_REUSE_DIGEST — setting this makes it attempt to copy the content digest value from the PKCS7 structure, so you can add a signer to an existing structure. if a matching digest value can't be found to copy, that's an error. the returned PKCS7 structure will be valid and finalized when this flag is set. ✅
  • PKCS7_PARTIAL — if this is set in addition to PKCS7_REUSE_DIGEST, then the PKCS7_SIGNER_INO structure will not be finalized, so you can add more attributes. in that case you need an explicit call to PKCS7_SIGNER_INFO_sign() to finalize it. one last step, don't skip it. 🙈
  • PKCS7_NOCERTS — the signer's certificate will not be included in the PKCS7 structure. caveat: you still have to supply the signer's certificate in the signcert parameter though. this can reduce the size of the signature if the signer's certificate can be obtained by other means — like a previously signed message. gorl loves a diet. 🍓
  • PKCS7_NOATTR — the signedData structure includes several PKCS#7 authenticatedAttributes, including the signing time, the PKCS#7 content type, and the supported list of ciphers in an SMIMECapabilities attribute. set this flag and no authenticatedAttributes will be used at all. 💀
  • PKCS7_NOSMIMECAP — softer version: just the SMIMECapabilities are omitted. everything else stays. ✨

if present, the SMIMECapabilities attribute indicates support for these algorithms: triple DES, 128 bit RC2, 64 bit RC2, DES and 40 bit RC2. and if any of these algorithms is disabled, it won't be included. simple as. ⭐

PKCS7_sign_add_signers() returns an internal pointer to the PKCS7_SIGNER_INFO structure it just added — you can use that to set additional attributes before it gets finalized. handy!

PKCS7_add_certificate() adds the certificate cert to the PKCS7 structure p7. cert can be an end-entity (signer) certificate or a CA certificate useful for chain building. this is done internally by PKCS7_sign_ex(3) and similar signing functions. you may have to use it before calling PKCS7_verify(3) in order to provide any missing certificate(s) needed for verification. chain building is self care. 🌈

PKCS7_add_crl() adds the CRL crl to the PKCS7 structure p7. call it to provide certificate status information to be included when signing, or to use when verifying the PKCS7 structure. either way it's serving. 👑

🦋 RETURN VALUES

  • PKCS7_sign_add_signers() returns an internal pointer to the PKCS7_SIGNER_INFO structure just added — or NULL if an error occurs. 😭
  • PKCS7_add_certificate() and PKCS7_add_crl() return 1 on success, 0 on error. clean, binary, iconic. ✨

💜 SEE ALSO

ERR_get_error(3), PKCS7_sign_ex(3), PKCS7_final(3), PKCS7_verify(3) — go read those too, iykyk. 📚

👑 HISTORY

the PPKCS7_sign_add_signer() function was added in OpenSSL 1.0.0. vintage, but make it fashion. 🎀

Copyright 2007-2016 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 🫶 this was OpenSSL 3.5.0, dated 2026-09-25, filed under PKCS7_SIGN_ADD_SIGNER(3ossl). go forth and sign something iconic 💅✨

📦 where this page comes from