PKCS12_SAFEBAG_CREATE_CERT(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💖 PKCS12_SAFEBAG_CREATE_CERT — the OpenSSL girlies' guide to safeBags 💖

okay so bestie, this one lives in the OpenSSL 3ossl manual, section 3, and it's literally all about creating PKCS#12 safeBag objects. If you've ever been like "hmm what even is a safeBag" — it's a lil container that holds one (1) piece of stuff inside a PKCS#12 file, and this page is the seven functions that make them. Let's go 🎀

✨ NAME ✨

PKCS12_SAFEBAG_create_cert, PKCS12_SAFEBAG_create_crl, PKCS12_SAFEBAG_create_secret, PKCS12_SAFEBAG_create0_p8inf, PKCS12_SAFEBAG_create0_pkcs8, PKCS12_SAFEBAG_create_pkcs8_encrypt, PKCS12_SAFEBAG_create_pkcs8_encrypt_ex — they create PKCS#12 safeBag objects. that's the whole job. slay 💅

🌸 SYNOPSIS 🌸

#include <openssl/pkcs12.h>

PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_cert(X509 *x509);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_crl(X509_CRL *crl);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_secret(int type, int vtype,
                                             const unsigned char* value,
                                             int len);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create0_p8inf(PKCS8_PRIV_KEY_INFO *p8);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create0_pkcs8(X509_SIG *p8);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_pkcs8_encrypt(int pbe_nid,
                                                    const char *pass,
                                                    int passlen,
                                                    unsigned char *salt,
                                                    int saltlen, int iter,
                                                    PKCS8_PRIV_KEY_INFO *p8inf);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_pkcs8_encrypt_ex(int pbe_nid,
                                                       const char *pass,
                                                       int passlen,
                                                       unsigned char *salt,
                                                       int saltlen, int iter,
                                                       PKCS8_PRIV_KEY_INFO *p8inf,
                                                       OSSL_LIB_CTX *ctx,
                                                       const char *propq);

🦋 DESCRIPTION 🦋

bestie, it's one function per bag type. here's the lineup 👑

  • PKCS12_SAFEBAG_create_cert() — makes a brand new PKCS12_SAFEBAG of type NID_certBag, and it's holding the certificate you hand it. certificate bag, certified cute 🌈
  • PKCS12_SAFEBAG_create_crl() — same energy, but it's a NID_crlBag and it's holding the crl you passed in. revocation never looked so good 💀
  • PKCS12_SAFEBAG_create_secret() — makes a new PKCS12_SAFEBAG of the type that corresponds to a PKCS#12 secretBag. The secretBag's contents get tagged as type, with an ASN1 value of type vtype built out of the bytes in value, which is len long. it's giving "custom content, my rules" ✨
  • PKCS12_SAFEBAG_create0_p8inf() — makes a new PKCS12_SAFEBAG of type NID_keyBag holding the PKCS8 structure you gave it. the "0" in the name is not a typo, it's just how she's spelled, periodt.
  • PKCS12_SAFEBAG_create0_pkcs8() — makes a new PKCS12_SAFEBAG of type NID_pkcs8ShroudedKeyBag holding the PKCS8 structure you gave it. shrouded = wrapped up, mysterious, main character energy 🧚
  • PKCS12_SAFEBAG_create_pkcs8_encrypt() — makes a new PKCS12_SAFEBAG of type NID_pkcs8ShroudedKeyBag by encrypting the PKCS8 you passed as p8inf. deets:
    • if pbe_nid is 0, a default encryption algorithm gets used (you don't have to pick one, she's got you 🫶)
    • pass is the passphrase
    • iter is the iteration count — and if iter is zero, a default value of 2048 is used
    • if salt is NULL, a salt gets generated randomly. we love a spontaneous queen 🎲
  • PKCS12_SAFEBAG_create_pkcs8_encrypt_ex() — literally identical to PKCS12_SAFEBAG_create_pkcs8_encrypt(), except it also lets you pass a library context ctx and a property query propq so you can select which algorithm implementations get used. same girl, upgraded fit 💅

📝 NOTES 📝

PKCS12_SAFEBAG_create_pkcs8_encrypt() makes assumptions about how the given pass phrase is encoded. go read passphrase-encoding(7) for the tea, bestie. fr fr.

also — PKCS12_SAFEBAG_create_secret() was added in OpenSSL 3.0. she's the new girl but she belongs here 💖

👑 RETURN VALUES 👑

All of these functions return a valid PKCS12_SAFEBAG structure... or NULL if an error happened 😭. that's it. valid bag or nothing.

⭐ CONFORMING TO ⭐

IETF RFC 7292 (<https://tools.ietf.org/html/rfc7292>) — the standards girlies said what they said and we're following it 🌸

🌈 SEE ALSO 🌈

PKCS12_create(3), PKCS12_add_safe(3), PKCS12_add_safes(3)

iykyk — go read those next if you want the whole saga 💜

🎀 HISTORY 🎀

PKCS12_SAFEBAG_create_pkcs8_encrypt_ex() was added in OpenSSL 3.0. the _ex variant is the newer, glowier version of her sister ✨

Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, no cap 🫶 this was OpenSSL 3.5.9, dated 2026-09-29, and it's the PKCS12_SAFEBAG_CREATE_CERT(3ossl) page — love that for us, go make some safeBags bestie 💖✨🎀

📦 where this page comes from