CMS_ADD0_CERT(3ossl)

💖 CMS_ADD0_CERT 💖

okay bestie, welcome to the CMS_ADD0_CERT(3ossl) page, straight out of the OpenSSL manual set ✨ this is your one-stop shop for adding certs and CRLs to a CMS thingy and getting them back out again 🎀

---

✨ NAME ✨

CMS_add0_cert, CMS_add1_cert, CMS_get1_certs, CMS_add0_crl, CMS_add1_crl, CMS_get1_crls — the CMS certificate and CRL utility functions 🦋

---

🌸 SYNOPSIS 🌸

#include <openssl/cms.h>

int CMS_add0_cert(CMS_ContentInfo *cms, X509 *cert);
int CMS_add1_cert(CMS_ContentInfo *cms, X509 *cert);
STACK_OF(X509) *CMS_get1_certs(CMS_ContentInfo *cms);

int CMS_add0_crl(CMS_ContentInfo *cms, X509_CRL *crl);
int CMS_add1_crl(CMS_ContentInfo *cms, X509_CRL *crl);
STACK_OF(X509_CRL) *CMS_get1_crls(CMS_ContentInfo *cms);

---

💅 DESCRIPTION 💅

So CMS_add0_cert() and CMS_add1_cert() add the certificate cert to cms — unless it's already in there, no dupes allowed bestie 💀. This is what CMS_sign_ex(3) and CMS_sign(3) use under the hood, and you can also call it yourself before CMS_verify(3) to help out with chain building during certificate validation. iconic.

Now here's the tea on the 0 vs the 1 ☕ the way that 0 in CMS_add0_cert() works is that it adds cert internally to cms, which means on success the caller must NOT free it 🙈. Meanwhile, if you're calling CMS_add1_cert(), the caller must free cert. don't mix these up fr fr.

cms has to be of type signed data or (authenticated) enveloped data. For signed data, a certificate like this can be used when signing or verifying to fill in the signer certificate, or to provide an extra CA certificate that might be needed for chain building in certificate validation 👑

CMS_get1_certs() returns all the certificates in cms 🎀

CMS_add0_crl() and CMS_add1_crl() add the CRL crl to cms. And yep, cms must be of type signed data or (authenticated) enveloped data here too. For signed data, such a CRL may be used in certificate validation with CMS_verify(3). You can hand it over both for inclusion when signing a CMS message and when verifying a signed CMS message, flexible queen 💅

CMS_get1_crls() returns all the CRLs in cms ✨

---

📝 NOTES 📝

The CMS_ContentInfo structure cms must be of type signed data or enveloped data or authenticated enveloped data — otherwise an error gets returned, no exceptions bestie 🚫

For signed data, certificates and CRLs get added to the certificates and crls fields of the SignedData structure. For enveloped data, they get added to OriginatorInfo 🦋

---

🔥 RETURN VALUES 🔥

CMS_add0_cert(), CMS_add1_cert(), CMS_add0_crl() and CMS_add1_crl() return 1 for success and 0 for failure. simple as that 💖

CMS_get1_certs() and CMS_get1_crls() return the STACK of certificates or CRLs, or NULL if there are none or an error occurs. Besides out-of-memory, the only error you'll realistically hit is if the cms type is invalid — so, like, vibe check your type first 🫶

---

👀 SEE ALSO 👀

ERR_get_error(3), CMS_sign(3), CMS_sign_ex(3), CMS_verify(3), CMS_encrypt(3)

---

🌈 HISTORY 🌈

CMS_add0_cert() and CMS_add1_cert() have been changed in OpenSSL 3.2 not to throw an error if a certificate to be added is already present 🎉 (yes, they used to be dramatic about it, now they're chill)

---

©️ COPYRIGHT ©️

Copyright 2008-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's a wrap bestie 🫶 this was OpenSSL 3.5.9, dated 2026-09-29, and yes the page name is literally CMS_ADD0_CERT(3ossl) 💜 go add some certs, you got this ✨🎀