CMS_ENVELOPEDDATA_CREATE(3ossl)

✨ CMS_ENVELOPEDDATA_CREATE 💅

okay bestie, welcome to CMS_ENVELOPEDDATA_CREATE(3ossl) — yes that's the whole name, it's giving long-distance relationship with your keyboard, but we're gonna get through it together 🫶

This is the one that makes CMS envelopes. Like, the actual envelope. The thing you put stuff in. Iconic behaviour honestly.

---

🌸 SYNOPSIS

#include <openssl/cms.h>

CMS_ContentInfo *
CMS_EnvelopedData_create_ex(const EVP_CIPHER *cipher, OSSL_LIB_CTX *libctx,
                            const char *propq);
CMS_ContentInfo *CMS_EnvelopedData_create(const EVP_CIPHER *cipher);

CMS_ContentInfo *
CMS_AuthEnvelopedData_create_ex(const EVP_CIPHER *cipher, OSSL_LIB_CTX *libctx,
                                const char *propq);
CMS_ContentInfo *CMS_AuthEnvelopedData_create(const EVP_CIPHER *cipher);

---

🎀 DESCRIPTION

So there's four of these girls and they all do basically the same thing, just with different levels of extra ✨

CMS_EnvelopedData_create_ex() builds you a CMS_ContentInfo structure with type NID_pkcs7_enveloped. The cipher is the symmetric cipher you wanna use. The library context libctx and the property query propq get used when pulling algorithms from providers — that's the whole point of the _ex version, she's fancy 💅

CMS_AuthEnvelopedData_create_ex() builds a CMS_ContentInfo structure with type NID_id_smime_ct_authEnvelopedData. Here cipher is the symmetric AEAD cipher you wanna use. And lowkey important: right now only AES variants with GCM mode are supported. That's it. That's the list. Don't come at me with anything else 🙈 The library context libctx and the property query propq are again used when retrieving algorithms from providers.

🚨 okay so this one matters: the algorithm you pass in that cipher parameter must support ASN1 encoding of its parameters. Non-negotiable bestie.

The recipients? You add those later, they don't come pre-loaded. Use CMS_add1_recipient_cert(3) or CMS_add0_recipient_key(3) — pick your fighter 🥊

Then you gotta finalize your CMS_ContentInfo structure with CMS_final(3), and then free it with CMS_ContentInfo_free(3). In that order. The way that forgetting to free is a crime against your own memory 😭

CMS_EnvelopedData_create() and CMS_AuthEnvelopedData_create() are the low-key versions of CMS_EnvelopedData_create_ex() and CMS_AuthEnvelopedData_create_ex() — same energy, except they just use the default values of NULL for both the library context libctx and the property query propq. No thoughts, head empty, defaults on 🌈

---

🦋 NOTES

So here's the tea: even though CMS_EnvelopedData_create_ex(), CMS_EnvelopedData_create(), CMS_AuthEnvelopedData_create_ex() and CMS_AuthEnvelopedData_create() all allocate you a brand new CMS_ContentInfo structure... applications don't usually call them directly. Like, at all. Fr fr. Most people just use the wrappers CMS_encrypt(3) and CMS_decrypt(3) instead. They're the main characters, these four are the supporting cast 💀

---

💖 RETURN VALUES

If the allocation fails, CMS_EnvelopedData_create_ex(), CMS_EnvelopedData_create(), CMS_AuthEnvelopedData_create_ex(), CMS_AuthEnvelopedData_create(), CMS_AuthEnvelopedData_create(), and CMS_AuthEnvelopedData_create_ex() all return NULL and set an error code — you can grab that with ERR_get_error(3).

Otherwise? They return a pointer to the newly allocated structure. Slay ✨

---

👑 SEE ALSO

• ERR_get_error(3)
• CMS_encrypt(3)
• CMS_decrypt(3)
• CMS_final(3)
• CMS_sign_ex(3)
• CMS_encrypt_ex(3)

---

🌈 HISTORY

• The CMS_EnvelopedData_create_ex() method was added in OpenSSL 3.0.
• CMS_AuthEnvelopedData_create() and CMS_AuthEnvelopedData_create_ex() were added in OpenSSL 3.5.

(so yes the auth ones are the babies of the group, born in 3.5, we love a fresh era 🍼)

---

💜 COPYRIGHT

Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

okay that's the whole page bestie, you ate that 🍓 go forth and create envelopes responsibly. this was 3.5.9 energy, dated 2026-09-29, and it lives under the name CMS_ENVELOPEDDATA_CREATE(3ossl) — ily, bye 💅🫶