PEM_BYTES_READ_BIO(3ossl)

💖 PEM_BYTES_READ_BIO 💖

okay bestie, so this is a page from the OpenSSL manual set (3ossl), and today we're talking about reading PEM-encoded stuff out of a BIO. it's giving ✨file parsing✨ but make it secure. let's GO.

---

🎀 NAME 🎀

PEM_bytes_read_bio, PEM_bytes_read_bio_secmem — read a PEM-encoded data structure from a BIO. literally their whole job. no cap.

---

✨ SYNOPSIS ✨

#include <openssl/pem.h>

int PEM_bytes_read_bio(unsigned char **pdata, long *plen, char **pnm,
                       const char *name, BIO *bp, pem_password_cb *cb,
                       void *u);
int PEM_bytes_read_bio_secmem(unsigned char **pdata, long *plen, char **pnm,
                              const char *name, BIO *bp, pem_password_cb *cb,
                              void *u);

---

🦋 DESCRIPTION 🦋

so PEM_bytes_read_bio() reads PEM-formatted data from the BIO bp — and when we say PEM we mean the IETF RFC 1421 and IETF RFC 7468 flavor 💅 — for whatever data type you passed in name (think RSA PRIVATE KEY, CERTIFICATE, etc.). it's out here doing exactly one thing and doing it well.

and the way it's sooo forgiving?? if multiple PEM-encoded data structures are chillin' in the same stream, PEM_bytes_read_bio() will just skip the non-matching data types and keep on reading. main character energy tbh. but — plot twist — non-PEM data hangin' around in the stream may cause an error. so keep your stream clean, bestie 🙈

okay so the PEM header can tell you the following data is encrypted. and if it is? it gets decrypted, and it'll wait on user input for a passphrase if it needs one. the password callback cb and rock u are what you use to grab that decryption passphrase, if applicable. teamwork! 🫶

some data types have compatibility aliases, like a file containing X509 CERTIFICATE matching a request for the deprecated type CERTIFICATE. (yes, deprecated. noted. moving on.) the actual type that the file indicates gets returned in *pnm — but only if pnm is non-NULL. and the caller must free the storage pointed to by *pnm. don't forget, or that's a leak 💀

the returned data is the DER-encoded form of the requested type, sitting in *pdata with length *plen. and again: the caller must free the storage pointed to by *pdata. i'm serious. free your memory. it's self care. 🧚

now, PEM_bytes_read_bio_secmem() is basically PEM_bytes_read_bio()'s more careful sibling — same energy, but it uses memory from the secure heap for its temporary buffers and for the storage returned in *pdata and *pnm. because of that, the caller has to use OPENSSL_secure_free() to free that storage. different free function, bestie. using the wrong one is not the vibe. ⭐

---

🌸 NOTES 🌸

okay so important caveat time, listen up:

PEM_bytes_read_bio_secmem() only enforces that the secure heap is used for storage allocated within the PEM processing stack. that's it. the BIO stack you're reading input from may also use temporary buffers, and those are not necessarily allocated from the secure heap. 😭

so if you're in a situation where you genuinely need the contents of the PEM file to only ever appear in memory from the secure heap, you've gotta be careful when you generate the BIO you pass as bp. specifically: using BIO_s_file() means you're using the operating system stdio functionality, and buffering is literally a feature of that. in those cases, BIO_s_fd() is likely to be more appropriate. lowkey a big deal if you care about this stuff. 🔥

also, these functions make no assumption about the pass phrase they receive from the password callback. it just gets treated as a byte sequence, periodt.

---

💜 RETURN VALUES 💜

PEM_bytes_read_bio() and PEM_bytes_read_bio_secmem() return 1 for success or 0 for failure. that's it, that's the whole system. binary. iconic. 👑

---

🌈 SEE ALSO 🌈

• PEM_read_bio_ex(3)
• passphrase-encoding(7)

---

🍓 HISTORY 🍓

PEM_bytes_read_bio_secmem() was introduced in OpenSSL 1.1.1. so it's not ancient, it's just got taste.

---

👑 COPYRIGHT 👑

Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

aww okay that's the whole page bestie, you read it all, so proud 🥹 remember: free *pdata and *pnm, and if you went secmem, use OPENSSL_secure_free(). mwah 💅

this little lore drop came to you courtesy of OpenSSL 3.5.9, dated 2026-09-29, filed under PEM_BYTES_READ_BIO(3ossl) — catch you in the next one, bestie 💖✨🎀