PKCS12_ITEM_DECRYPT_D2I(3ossl)

💖 PKCS12_ITEM_DECRYPT_D2I 💖

okay bestie, so this is the <openssl/pkcs12.h> page from the OpenSSL manual (section 3ossl, as you can probs tell from the name up top ✨). It's all about encrypting and decrypting PKCS12 items, and honestly? Lowkey iconic. Let's get into it 🎀

---

✨ NAME ✨

PKCS12_item_decrypt_d2i, PKCS12_item_decrypt_d2i_ex, PKCS12_item_i2d_encrypt, PKCS12_item_i2d_encrypt_ex — the PKCS12 item encrypt/decrypt girlies 🫶

🌸 SYNOPSIS 🌸

#include <openssl/pkcs12.h>

void *PKCS12_item_decrypt_d2i(const X509_ALGOR *algor, const ASN1_ITEM *it,
                              const char *pass, int passlen,
                              const ASN1_OCTET_STRING *oct, int zbuf);
void *PKCS12_item_decrypt_d2i_ex(const X509_ALGOR *algor, const ASN1_ITEM *it,
                                 const char *pass, int passlen,
                                 const ASN1_OCTET_STRING *oct, int zbuf,
                                 OSSL_LIB_CTX *libctx,
                                 const char *propq);
ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt(X509_ALGOR *algor,
                                           const ASN1_ITEM *it,
                                           const char *pass, int passlen,
                                           void *obj, int zbuf);
ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt_ex(X509_ALGOR *algor,
                                              const ASN1_ITEM *it,
                                              const char *pass, int passlen,
                                              void *obj, int zbuf,
                                              OSSL_LIB_CTX *ctx,
                                              const char *propq);

💅 DESCRIPTION 💅

so PKCS12_item_decrypt_d2i() and PKCS12_item_decrypt_d2i_ex() decrypt an octet string that's holding an ASN.1 encoded object, using the algorithm algor and the password pass with length passlen. And listen — if zbuf is nonzero, the output buffer gets zeroed after the decrypt. Cleanup era 🧹✨

Then PKCS12_item_i2d_encrypt() and PKCS12_item_i2d_encrypt_ex() do the reverse glow-up: they encrypt an ASN.1 object it using the algorithm algor and password pass of length passlen, and hand you back the encoded object in obj. And yeah — if zbuf is nonzero, the buffer holding the input encoding gets zeroed after the encrypt. No leftover crumbs, periodt 💀

And the functions ending in _ex()? Those are the ones that let you bring a library context ctx and a property query propq to the party, so you can pick which algorithm implementations get used. Choose-your-own-adventure but make it crypto 👑

not me specifying propq every single time… it's giving main character energy fr fr

🔥 RETURN VALUES 🔥

• PKCS12_item_decrypt_d2i() and PKCS12_item_decrypt_d2i_ex() — return the decrypted object 🎁, or NULL if something went wrong 😭
• PKCS12_item_i2d_encrypt() and PKCS12_item_i2d_encrypt_ex() — return the encrypted data as an ASN.1 Octet String 📦, or NULL if something went wrong 😭

🦋 SEE ALSO 🦋

PKCS12_pbe_crypt_ex(3), PKCS8_encrypt_ex(3) — go read those too bestie, iykyk 💜

👑 HISTORY 👑

PKCS12_item_decrypt_d2i_ex() and PKCS12_item_i2d_encrypt_ex() were added in OpenSSL 3.0. So if you're on anything older, those two simply did not exist yet — she was born in 3.0, no cap ⭐

🌈 COPYRIGHT 🌈

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie 💖 mwah, go zero those buffers 🎀

OpenSSL 3.5.9, dated 2026-09-29 — this was PKCS12_ITEM_DECRYPT_D2I(3ossl), signing off 🦋✨