SMIME_READ_PKCS7(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💌 SMIME_READ_PKCS7 — bestie, let's parse an S/MIME message 💌

okay so this one's the SMIME_read_PKCS7(3ossl) page from the OpenSSL fam — it's all about pulling apart an S/MIME message and getting a PKCS7 structure out the other side. it's giving "email crypto but make it parsed" ✨

🌸 NAME 🌸

SMIME_read_PKCS7_ex, SMIME_read_PKCS7 — parse an S/MIME message. that's it, that's the whole gig 💅

🎀 SYNOPSIS 🎀

ok so first you gotta bring in the header, no cap:

#include <openssl/pkcs7.h>

and here are the two functions, literally exactly as they are:

PKCS7 *SMIME_read_PKCS7_ex(BIO *bio, BIO **bcont, PKCS7 **p7);
PKCS7 *SMIME_read_PKCS7(BIO *in, BIO **bcont);

🦋 DESCRIPTION 🦋

so SMIME_read_PKCS7() parses a message that's in S/MIME format. that's the whole vibe. 🫶

in is the BIO you're reading the message from — that's your source, your main character input stream.

now here's the tea: if cleartext signing is being used, then the content gets saved into a memory bio, and that bio gets written to *bcont. but if it's not cleartext signing? then *bcont gets set to NULL. simple as that 💁

the parsed PKCS#7 structure gets returned — or, if something went wrong, you get NULL. 😭

now SMIME_read_PKCS7_ex() is basically SMIME_read_PKCS7()'s cooler sibling — super similar, but it can optionally supply a previously created p7 PKCS#7 object. and if p7 is NULL? then honestly it's identical to SMIME_read_PKCS7(), no notes. if you wanna create a p7 object yourself, use PKCS7_new_ex(3). iykyk ⭐

✨ NOTES ✨

so if *bcont is not NULL, that means the message is clear text signed — that's your signal, bestie 👑

and once you've got that, *bcont can then be passed to PKCS7_verify() with the PKCS7_DETACHED flag set. slay.

otherwise — like if it's not clear text signed — the type of the returned structure can be figured out using PKCS7_type_is_enveloped(), etc. etc. 💫

ok this next bit is important for future-proofing: if bcont is not NULL, you should initialize *bcont to NULL. not me being dramatic, it's literally what the page says. 🙈

like, for example:

BIO *cont = NULL;
PKCS7 *p7;

p7 = SMIME_read_PKCS7(in, &cont);

iconic. ate. no crumbs. 🔥

💀 BUGS 💀

ok so real talk, the MIME parser used by SMIME_read_PKCS7() is, and i quote the vibes, "somewhat primitive." it'll handle most S/MIME messages, but more complex compound formats may just... not work. 💀

also, the parser assumes the PKCS7 structure is always base64 encoded. so it will not handle the case where it's in binary format, or where it uses quoted printable format. so if you're doing either of those, this isn't the function for you, sorry bestie 😭

and last but definitely not least: using a memory BIO to hold the signed content limits the size of the message you can process, because, you know, memory restraints. the page straight up says a streaming single pass option should be available. so yeah — it's a known limitation, not a skill issue 🫠

🌈 RETURN VALUES 🌈

SMIME_read_PKCS7_ex() and SMIME_read_PKCS7() return a valid PKCS7 structure — or NULL if an error occurred. 😭

and if you did get an error, you can grab it from ERR_get_error(3). your error info is right there, go get it 💜

👑 SEE ALSO 👑

go read these too, fr fr:

🧚 HISTORY 🧚

SMIME_read_PKCS7_ex() is the newbie here — it was added in OpenSSL 3.0. periodt. 🎀

Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

ok bye bestie, this page's footer says version 3.5.0 and date 2026-09-25 for SMIME_read_PKCS7(3ossl) — so you know exactly which tea you're sipping 🌸💖✨

📦 where this page comes from