PKCS12_PARSE(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💖 PKCS12_PARSE(3ossl) 💖

okay bestie, so this is a page from the OpenSSL manual — section 3ossl, the library-functions girlies — and we're about to parse a whole PKCS#12 structure together. no cap. grab a strawberry 🍓 and let's go.

✨ NAME ✨

PKCS12_parse — literally just: parse a PKCS#12 structure. that's the whole job. she's focused, she's employed, she's iconic. 💅

✨ SYNOPSIS ✨

#include <openssl/pkcs12.h>

int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
                 STACK_OF(X509) **ca);

✨ DESCRIPTION ✨

PKCS12_parse() parses a PKCS12 structure. that's the vibe. 🌈

So here's the cast of characters, bestie:

  • p12 is the PKCS12 structure you wanna parse. the main character, truly.
  • pass is the passphrase to use. the secret handshake. 🤫
  • If everything goes well (and we're manifesting that it does ✨), the private key gets written to *pkey, the corresponding certificate goes to *cert, and any additional certificates land in *ca. slay. 👑

🎀 NOTES 🎀

Okay so here's the fine print, and it's actually important, so don't skip it:

  • Each of the parameters pkey, cert, and ca can be NULL. if you pass NULL, that thing gets discarded — so the private key, the corresponding certificate, or the additional certificates respectively just get thrown away like an old situationship. 💀
  • If either of pkey and cert is non-NULL, the variable it points to gets initialized.
  • If ca is non-NULL and *ca is NULL, a brand new STACK gets allocated for you. so generous. 🫶
  • If ca is non-NULL and *ca is already a valid STACK, then the additional certificates get appended to *ca, in the given order. order matters, periodt.

Also: the friendlyName and localKeyID attributes (if they're even present) on each certificate get stored in the alias and keyid attributes of the X509 structure. cute little name tags. 🏷️

Now for the encoding tea, because this is where people get got:

The parameter pass is interpreted as a string in the UTF-8 encoding. If it is not valid UTF-8, then it is assumed to be ISO8859-1 instead. the audacity, honestly. 😭

In particular, this means that passwords in the locale character set (or code page on Windows) must potentially be converted to UTF-8 before use. This may include passwords from local text files, or input from the terminal or command line.

Refer to the documentation of UI_OpenSSL(3), for example. iykyk.

⭐ RETURN VALUES ⭐

PKCS12_parse() returns 1 for success and zero if an error occurred. binary queen. 🎀

The error can be obtained from ERR_get_error(3).

💀 BUGS 💀

not me having to report these but okay, we're being honest:

  • Only a single private key and corresponding certificate is returned by this function. More complex PKCS#12 files with multiple private keys will only return the first match. she's monogamous, she doesn't have time for the rest of them. 🙈
  • Only friendlyName and localKeyID attributes are currently stored in certificates. Other attributes are discarded. gone. reduced to atoms. 🦋
  • Attributes currently cannot be stored in the private key EVP_PKEY structure. the key is simply not accepting new info rn. 😤

🌸 SEE ALSO 🌸

Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

aaaand that's the whole page bestie, no crumbs left. 🧚 this was version 3.5.9, dated 2026-09-29, and yes she ate. 💜

📦 where this page comes from