PKCS12_PACK_P7ENCDATA(3ossl)

💖 PKCS12_pack_p7encdata — bestie's guide to packing safeBags into a PKCS#7 encrypted data object 💖

okay so you found the PKCS12_pack_p7encdata page in the OpenSSL manual (section 3ossl, in case you were wondering) and you're like "what is this" — don't worry, I got you. This is the thing that takes a little stack of PKCS#12 safeBags and wraps them up all cozy in a PKCS#7 encrypted data object. It's giving ✨gift wrapping but cryptographic✨.

---

🎀 NAME 🎀

PKCS12_pack_p7encdata, PKCS12_pack_p7encdata_ex — literally just pack a set of PKCS#12 safeBags into a PKCS#7 encrypted data object. That's the whole job. No cap.

---

✨ SYNOPSIS ✨

#include <openssl/pkcs12.h>

PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen,
                             unsigned char *salt, int saltlen, int iter,
                             STACK_OF(PKCS12_SAFEBAG) *bags);
PKCS7 *PKCS12_pack_p7encdata_ex(int pbe_nid, const char *pass, int passlen,
                                unsigned char *salt, int saltlen, int iter,
                                STACK_OF(PKCS12_SAFEBAG) *bags,
                                OSSL_LIB_CTX *ctx, const char *propq);

---

💅 DESCRIPTION 💅

So PKCS12_pack_p7encdata() generates a PKCS#7 ContentInfo object of encrypted-data type out of the set of safeBags called bags. Slay. 🌸

The algorithm ID in pbe_nid can be a PKCS#12 or PKCS#5 password based encryption algorithm, OR a cipher algorithm. Two vibes, both valid. And if you do pass a cipher algorithm, then the PKCS#5 PBES2 algorithm gets used with that cipher as a parameter. iykyk. 🔥

Then the actual encryption operation takes these inputs, bestie:

• the password pass of length passlen
• the salt salt of length saltlen
• the iteration count iter

Meanwhile PKCS12_pack_p7encdata_ex() operates similar to the above (same energy, same job 💖) BUT it also lets you hand in a library context ctx and a property query propq to be used to select the algorithm implementation. Fancy. Iconic. We love options.

---

🫶 RETURN VALUES 🫶

A PKCS7 object if it works out — or NULL if an error occurred. 😭 That's it. That's the whole deal.

---

🌈 CONFORMING TO 🌈

IETF RFC 2315 (<https://tools.ietf.org/html/rfc2315>) — yes bestie, we're standards-compliant, periodt. 👑

---

🦋 SEE ALSO 🦋

• PKCS12_pbe_crypt_ex(3) — go read that one too, it's the sibling 💜

---

⭐ HISTORY ⭐

PKCS12_pack_p7encdata_ex() was added in OpenSSL 3.0. The original one was already out here doing its thing before that. 🎀

---

💀 COPYRIGHT 💀

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

fr fr, read the license. Not me being the responsible one for once 🙈

---

and that's the whole page, bestie!! 💖✨ this was pulled from OpenSSL 3.5.9, dated 2026-09-29, and it's the PKCS12_PACK_P7ENCDATA(3ossl) manual. go encrypt something cute 🎀🦋💅