PKCS12_ADD_CERT(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💖 PKCS12_ADD_CERT 💖

okay bestie, welcome to the 3ossl manual page for PKCS12_add_cert — plus its whole little friend group: PKCS12_add_key, PKCS12_add_key_ex, and PKCS12_add_secret. this is the "add an object to a set of PKCS#12 safeBags" page and it is lowkey iconic 🎀

✨ NAME ✨

PKCS12_add_cert, PKCS12_add_key, PKCS12_add_key_ex, PKCS12_add_secret — Add an object to a set of PKCS#12 safeBags 🫶

🌸 SYNOPSIS 🌸

#include <openssl/pkcs12.h>

PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert);
PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags,
                              EVP_PKEY *key, int key_usage, int iter,
                              int key_nid, const char *pass);
PKCS12_SAFEBAG *PKCS12_add_key_ex(STACK_OF(PKCS12_SAFEBAG) **pbags,
                                  EVP_PKEY *key, int key_usage, int iter,
                                  int key_nid, const char *pass,
                                  OSSL_LIB_CTX *ctx, const char *propq);

PKCS12_SAFEBAG *PKCS12_add_secret(STACK_OF(PKCS12_SAFEBAG) **pbags,
                                 int nid_type, const unsigned char *value, int len);

🦋 DESCRIPTION 🦋

so like, all four of these functions do the same main character move: they create a brand-new PKCS12_SAFEBAG and drop it into the set of safeBags living in pbags. no cap. ✨

  • PKCS12_add_cert() — makes a PKCS#12 certBag holding the certificate you hand it, then adds that bag to the set of PKCS#12 safeBags. it's giving "here's my cert, put it in the bag" 💅
  • PKCS12_add_key() — makes a PKCS#12 keyBag (that's the unencrypted one) or a pkcs8shroudedKeyBag (the encrypted one) holding the EVP_PKEY you gave it, and adds it to the set of PKCS#12 safeBags. now listen: if key_nid is not -1, the key gets encrypted with the supplied algorithm, using pass as the passphrase and iter as the iteration count. and if iter is zero? a default iteration count value of 2048 is used. periodt. 🔥
  • PKCS12_add_key_ex() — literally identical to PKCS12_add_key(), except it also lets a library context ctx and a property query propq be used to select algorithm implementations. that's it, that's the whole glow-up. 👑
  • PKCS12_add_secret() — makes a PKCS#12 secretBag with an OID corresponding to the supplied nid_type, holding the supplied value as an ASN1 octet string. then it gets added to the set of PKCS#12 safeBags. sneaky little secret, we love her 🤫💜

⭐ NOTES ⭐

if a certificate contains an alias or a keyid, then that will be used for the corresponding friendlyName or localKeyID in the PKCS12 structure. so the cert basically already picked out its own nickname, iykyk. 🎀

heads up bestie: PKCS12_add_key() makes assumptions regarding the encoding of the given pass phrase. see passphrase-encoding(7) for more information. don't skip that one, fr fr. 😭

🌈 RETURN VALUES 🌈

a valid PKCS12_SAFEBAG structure, or NULL if an error occurred. that's the whole vibe check. 💀

👑 CONFORMING TO 👑

IETF RFC 7292 (<https://tools.ietf.org/html/rfc7292>) — we stay standards-compliant in this house. 💖

🧚 SEE ALSO 🧚

🍓 HISTORY 🍓

PKCS12_add_secret() and PKCS12_add_key_ex() were added in OpenSSL 3.0. glow-up acquired. ✨

Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie!! 🫶 this one came from OpenSSL 3.5.9, dated 2026-09-29, and it goes by PKCS12_ADD_CERT(3ossl). mwah, go forth and bag those safeBags 💅🌸

📦 where this page comes from