PKCS7_SIGN_ADD_SIGNER(3ossl)

💖 PKCS7_SIGN_ADD_SIGNER 💖

okay bestie, welcome to the 3ossl manual page for the OpenSSL functions PKCS7_sign_add_signer, PKCS7_add_certificate and PKCS7_add_crl — aka the little helpers that add information to a PKCS7 structure. no cap, that's the whole vibe. ✨

---

✨ SYNOPSIS ✨

#include <openssl/pkcs7.h>

PKCS7_SIGNER_INFO *PKCS7_sign_add_signer(PKCS7 *p7, X509 *signcert,
                                         EVP_PKEY *pkey, const EVP_MD *md, int flags);
int PKCS7_add_certificate(PKCS7 *p7, X509 *cert);
int PKCS7_add_crl(PKCS7 *p7, X509_CRL *crl);

---

🌸 DESCRIPTION 🌸

so PKCS7_sign_add_signer() is the main character here 💅 — it adds a signer to a PKCS7 signed data structure p7, using the certificate signcert, the private key pkey, and the message digest md.

where do you get that PKCS7 structure from, you ask? great question 🫶 you grab it from an initial call to PKCS7_sign() with the PKCS7_PARTIAL flag set — or, alternatively, when you're re-signing a valid PKCS#7 signed data structure.

if the md parameter is NULL, then the default digest for the public key algorithm gets used. easy peasy. 🎀

⚠️ heads up though: unless the PKCS7_REUSE_DIGEST flag is set, the PKCS7 structure you get back is not complete — you still have to finalize it, either by streaming (if that's applicable to you) or by calling PKCS7_final(). don't forget, bestie 😭

---

🔥 NOTES 🔥

the whole point of this function is giving you finer control over a PKCS#7 signed data structure — for when the simpler PKCS7_sign() function's defaults just aren't it. like, say you need multiple signers, or non-default digest algorithms. then this is your girl. 👑

any of the following flags can be passed in the flags parameter — and yes, you can OR them together, go off 🧚

• PKCS7_REUSE_DIGEST — if this is set, it attempts to copy the content digest value from the PKCS7 structure, so you can add a signer to an existing structure. an error occurs if a matching digest value can't be found to copy. when this flag is set, the returned PKCS7 structure will be valid and finalized. slay.
• PKCS7_PARTIAL — if this is set in addition to PKCS7_REUSE_DIGEST, then the PKCS7_SIGNER_INO structure will not be finalized, so you can add additional attributes to it. in that case you need an explicit call to PKCS7_SIGNER_INFO_sign() to finalize it. no skipping that step 🙈
• PKCS7_NOCERTS — if this is set, the signer's certificate will not be included in the PKCS7 structure. but listen — the signer's certificate must still be supplied in the signcert parameter though. this can shrink the size of the signature if the signer's certificate can be obtained by other means, like, say, from a previously signed message. ✨
• PKCS7_NOATTR — the signedData structure includes several PKCS#7 authenticatedAttributes, including the signing time, the PKCS#7 content type, and the supported list of ciphers in an SMIMECapabilities attribute. if PKCS7_NOATTR is set, then no authenticatedAttributes will be used.
• PKCS7_NOSMIMECAP — if this is set, then just the SMIMECapabilities are omitted. (the rest of the attributes stay, bestie 💜)

if it's present, the SMIMECapabilities attribute indicates support for the following algorithms: triple DES, 128 bit RC2, 64 bit RC2, DES and 40 bit RC2. and if any of these algorithms is disabled, then it will not be included. periodt. 💅

PKCS7_sign_add_signers() returns an internal pointer to the PKCS7_SIGNER_INFO structure that was just added — which you can use to set additional attributes before it gets finalized. iconic.

now, the other two 🦋

PKCS7_add_certificate() adds the certificate cert to the PKCS7 structure p7. that cert may be an end-entity (signer) certificate or a CA certificate that's useful for chain building. this is done internally by PKCS7_sign_ex(3) and similar signing functions. you might have to use it before calling PKCS7_verify(3) in order to provide any missing certificate(s) needed for verification. yk, so verification doesn't just flop. 💀

PKCS7_add_crl() adds the CRL crl to the PKCS7 structure p7. you can call this to provide certificate status information to be included when signing, or to use when verifying the PKCS7 structure. 🌈

---

⭐ RETURN VALUES ⭐

• PKCS7_sign_add_signers() returns an internal pointer to the PKCS7_SIGNER_INFO structure just added — or NULL if an error occurs. 😭
• PKCS7_add_certificate() and PKCS7_add_crl() return 1 on success, 0 on error.

---

👑 SEE ALSO 👑

ERR_get_error(3), PKCS7_sign_ex(3), PKCS7_final(3), PKCS7_verify(3)

---

🎀 HISTORY 🎀

the PPKCS7_sign_add_signer() function was added in OpenSSL 1.0.0. throwback fr fr.

---

💜 COPYRIGHT 💜

Copyright 2007-2016 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie 🫶 this was OpenSSL 3.5.9, dated 2026-09-29 — go forth and sign your PKCS#7 structures responsibly, mwah 💖✨🌸