PEM_READ_BIO_EX(3ossl)

💖 PEM_READ_BIO_EX 💖

okay bestie so this one lives in the OpenSSL fam, and it's literally the manual page for PEM_read_bio_ex, PEM_FLAG_SECURE, PEM_FLAG_EAY_COMPATIBLE, and PEM_FLAG_ONLY_B64 — aka read PEM format files with custom processing. yes that's the whole vibe. custom processing. we love a bespoke read. ✨

---

✨ SYNOPSIS ✨

like here's the tea, go ahead and include this:

#include <openssl/pem.h>

#define PEM_FLAG_SECURE             0x1
#define PEM_FLAG_EAY_COMPATIBLE     0x2
#define PEM_FLAG_ONLY_B64           0x4
int PEM_read_bio_ex(BIO *in, char **name, char **header,
                    unsigned char **data, long *len, unsigned int flags);

---

🌸 DESCRIPTION 🌸

so PEM_read_bio_ex() reads in PEM formatted data from an input BIO, and it hands you back three-ish things: the name of the type of contained data, the header info about the possibly-encrypted data, and the binary data payload (after base64 decoding, obvi). ngl, you should generally only use it to implement PEM_read_bio_-family functions for specific data types or other usage — but it's exposed to y'all so you get greater flexibility over how processing is performed, if you need it. 💅

• if PEM_FLAG_SECURE is set — the intermediate buffers used to read in lines of input are allocated from the secure heap. fancy.
• if PEM_FLAG_EAY_COMPATIBLE is set — a simple algorithm is used to remove whitespace and control characters from the end of each line, so as to be compatible with the historical behavior of PEM_read_bio(). it's giving legacy respect. 🫶
• if PEM_FLAG_ONLY_B64 is set — all characters are required to be valid base64 characters (or newlines); non-base64 characters are treated as end of input.
• if neither PEM_FLAG_EAY_COMPATIBLE nor PEM_FLAG_ONLY_B64 is set — control characters are ignored. 🍓
• if both PEM_FLAG_EAY_COMPATIBLE and PEM_FLAG_ONLY_B64 are set — an error is returned; these options are not compatible with each other. periodt. pick a lane bestie 😭

---

📝 NOTES 📝

the caller must release the storage allocated for *name, *header, and *data. like pls don't leak, that's not the vibe.

if PEM_FLAG_SECURE was set, use OPENSSL_secure_free(); otherwise, OPENSSL_free() is used. get it right or the memory will simply haunt you 💀

---

⭐ RETURN VALUES ⭐

PEM_read_bio_ex() returns 1 for success or 0 for failure. that's it. binary queen. 👑

---

🌈 SEE ALSO 🌈

• PEM_bytes_read_bio(3) — go read her too, iykyk

---

🦋 HISTORY 🦋

the PEM_read_bio_ex() function was added in OpenSSL 1.1.1. a classic. an icon. she's been here. ✨

---

💜 COPYRIGHT 💜

Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie, no cap — this one's from 3.5.9, dated 2026-09-29, and yes she's still serving PEM_READ_BIO_EX(3ossl) energy 💅🎀🌸