PKCS12_ADD_SAFE(3ossl)

💖 PKCS12_ADD_SAFE 💖

okay bestie, pull up a chair, we're doing pkcs12_add_safe — that's the page from the OpenSSL manual, section 3ossl 🎀. It's all about building PKCS#12 structures and stuffing objects into them. Sounds scary, is actually just legos but for crypto. Let's go ✨

---

🌸 NAME 🌸

PKCS12_add_safe, PKCS12_add_safe_ex, PKCS12_add_safes, PKCS12_add_safes_ex — Create and add objects to a PKCS#12 structure 🫶

---

🦋 SYNOPSIS 🦋

#include <openssl/pkcs12.h>

int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags,
                    int safe_nid, int iter, const char *pass);
int PKCS12_add_safe_ex(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags,
                       int safe_nid, int iter, const char *pass,
                       OSSL_LIB_CTX *ctx, const char *propq);

PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int p7_nid);
PKCS12 *PKCS12_add_safes_ex(STACK_OF(PKCS7) *safes, int p7_nid,
                            OSSL_LIB_CTX *ctx, const char *propq);

---

👑 DESCRIPTION 👑

PKCS12_add_safe() makes a brand-new PKCS7 contentInfo, drops the PKCS12_SAFEBAGs you handed it inside, and adds the whole thing to a set of PKCS7 contentInfos. And what kind of contentInfo you get? That's fully decided by safe_nid, bestie:

• If safe_nid is -1, you get a plain PKCS7 data contentInfo. Simple. Clean. No encryption, no drama 💅
• If safe_nid is a valid PBE algorithm NID, you get a PKCS7 encryptedData contentInfo ✨. The algorithm uses pass as the passphrase and iter as the iteration count. And if iter is zero? Not me forgetting the iterations — the default value for the iteration count is 2048 and it gets used instead 🫶
• If safe_nid is 0, you get a PKCS7 encryptedData contentInfo too, but this time with a default encryption algorithm. Currently that's NID_pbe_WithSHA1And3_Key_TripleDES_CBC 👑

PKCS12_add_safe_ex() is literally the same as PKCS12_add_safe(), except it lets a library context ctx and a property query propq get involved in picking which algorithm implementations get used 🌈

PKCS12_add_safes() builds a PKCS12 structure that holds the set of PKCS7 contentInfos you gave it. The safes get enclosed first inside a PKCS7 contentInfo of type p7_nid. And rn the only supported type is NID_pkcs7_data — that's it, that's the whole menu 😭

PKCS12_add_safes_ex() is literally the same as PKCS12_add_safes(), except again: library context ctx and property query propq come along to select algorithm implementations 🌸

---

📝 NOTES 📝

okay heads up, this one matters: PKCS12_add_safe() makes assumptions regarding the encoding of the given pass phrase. Like, it just assumes. Go read passphrase-encoding(7) for the whole story, iykyk 🙈

---

💀 RETURN VALUES 💀

• PKCS12_add_safe() returns 1 meaning slay (success), or 0 meaning nope (failure) 😭
• PKCS12_add_safes() returns a valid PKCS12 structure, or NULL if an error happened 💀

---

🌈 CONFORMING TO 🌈

IETF RFC 7292 (<https://tools.ietf.org/html/rfc7292>) — yes, we're standards girlies 💜

---

🎀 SEE ALSO 🎀

• PKCS12_create(3)

---

⭐ HISTORY ⭐

PKCS12_add_safe_ex() and PKCS12_add_safes_ex() were added in OpenSSL 3.0 — the _ex girlies are the new kids, periodt ✨

---

💅 COPYRIGHT 💅

Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie!! 🦋✨ this was OpenSSL 3.5.9, dated 2026-09-29, and it's the PKCS12_ADD_SAFE(3ossl) manual — go forth and encrypt your contentInfos responsibly, ily 💖🎀👑