D2I_RSAPRIVATEKEY(3ossl)

📦

version 3.5.9 · 8 versions

3.5.9 · fedora 43, fedora 44 (latest)
3.5.9 · centos-stream 9
3.5.9 · centos-stream 10
3.5.9 · alpine 3.22
3.5.9 · alpine 3.23, alpine 3.24
3.5.8 · fedora 43
3.5.1 · fedora 43
3.5.5 · fedora 44

🎀 D2I_RSAPRIVATEKEY(3ossl) 🎀

okay bestie, sit down, hydrate, because today we're reading the OpenSSL manpage for d2i_RSAPRIVATEKEY(3ossl) 💖 and honestly? It's giving "vintage". Everything on this page is deprecated since OpenSSL 3.0, but we're still learning it, because you will meet it in the wild and you deserve to know what's going on. no cap.

🌸 NAME 🌸

the whole squad of functions, present and accounted for (and yes, the whole thing is marked DEPRECATED):

the decode girlies: d2i_DSAPrivateKey, d2i_DSAPrivateKey_bio, d2i_DSAPrivateKey_fp, d2i_DSAPublicKey, d2i_DSA_PUBKEY, d2i_DSA_PUBKEY_bio, d2i_DSA_PUBKEY_fp, d2i_DSAparams, d2i_RSAPrivateKey, d2i_RSAPrivateKey_bio, d2i_RSAPrivateKey_fp, d2i_RSAPublicKey, d2i_RSAPublicKey_bio, d2i_RSAPublicKey_fp, d2i_RSA_PUBKEY, d2i_RSA_PUBKEY_bio, d2i_RSA_PUBKEY_fp, d2i_DHparams, d2i_DHparams_bio, d2i_DHparams_fp, d2i_ECParameters, d2i_ECPrivateKey, d2i_ECPrivateKey_bio, d2i_ECPrivateKey_fp, d2i_EC_PUBKEY, d2i_EC_PUBKEY_bio, d2i_EC_PUBKEY_fp
the encode girlies: i2d_RSAPrivateKey, i2d_RSAPrivateKey_bio, i2d_RSAPrivateKey_fp, i2d_RSAPublicKey, i2d_RSAPublicKey_bio, i2d_RSAPublicKey_fp, i2d_RSA_PUBKEY, i2d_RSA_PUBKEY_bio, i2d_RSA_PUBKEY_fp, i2d_DHparams, i2d_DHparams_bio, i2d_DHparams_fp, i2d_DSAPrivateKey, i2d_DSAPrivateKey_bio, i2d_DSAPrivateKey_fp, i2d_DSAPublicKey, i2d_DSA_PUBKEY, i2d_DSA_PUBKEY_bio, i2d_DSA_PUBKEY_fp, i2d_DSAparams, i2d_ECParameters, i2d_ECPrivateKey, i2d_ECPrivateKey_bio, i2d_ECPrivateKey_fp, i2d_EC_PUBKEY, i2d_EC_PUBKEY_bio, i2d_EC_PUBKEY_fp

✨ SYNOPSIS ✨

so here's the tea: all of these have been deprecated since OpenSSL 3.0, and you can hide them entirely by defining OPENSSL_API_COMPAT with a suitable version value — go check openssl_user_macros(7) for that 🫶

the decoders:

TYPE *d2i_TYPEPrivateKey(TYPE **a, const unsigned char **ppin, long length);
TYPE *d2i_TYPEPrivateKey_bio(BIO *bp, TYPE **a);
TYPE *d2i_TYPEPrivateKey_fp(FILE *fp, TYPE **a);
TYPE *d2i_TYPEPublicKey(TYPE **a, const unsigned char **ppin, long length);
TYPE *d2i_TYPEPublicKey_bio(BIO *bp, TYPE **a);
TYPE *d2i_TYPEPublicKey_fp(FILE *fp, TYPE **a);
TYPE *d2i_TYPEparams(TYPE **a, const unsigned char **ppin, long length);
TYPE *d2i_TYPEparams_bio(BIO *bp, TYPE **a);
TYPE *d2i_TYPEparams_fp(FILE *fp, TYPE **a);
TYPE *d2i_TYPE_PUBKEY(TYPE **a, const unsigned char **ppin, long length);
TYPE *d2i_TYPE_PUBKEY_bio(BIO *bp, TYPE **a);
TYPE *d2i_TYPE_PUBKEY_fp(FILE *fp, TYPE **a);

and the encoders (notice the const TYPE * and non-const twins, we love an inclusive king):

int i2d_TYPEPrivateKey(const TYPE *a, unsigned char **ppout);
int i2d_TYPEPrivateKey(TYPE *a, unsigned char **ppout);
int i2d_TYPEPrivateKey_fp(FILE *fp, const TYPE *a);
int i2d_TYPEPrivateKey_fp(FILE *fp, TYPE *a);
int i2d_TYPEPrivateKey_bio(BIO *bp, const TYPE *a);
int i2d_TYPEPrivateKey_bio(BIO *bp, TYPE *a);
int i2d_TYPEPublicKey(const TYPE *a, unsigned char **ppout);
int i2d_TYPEPublicKey(TYPE *a, unsigned char **ppout);
int i2d_TYPEPublicKey_fp(FILE *fp, const TYPE *a);
int i2d_TYPEPublicKey_fp(FILE *fp, TYPE *a);
int i2d_TYPEPublicKey_bio(BIO *bp, const TYPE *a);
int i2d_TYPEPublicKey_bio(BIO *bp, TYPE *a);
int i2d_TYPEparams(const TYPE *a, unsigned char **ppout);
int i2d_TYPEparams(TYPE *a, unsigned char **ppout);
int i2d_TYPEparams_fp(FILE *fp, const TYPE *a);
int i2d_TYPEparams_fp(FILE *fp, TYPE *a);
int i2d_TYPEparams_bio(BIO *bp, const TYPE *a);
int i2d_TYPEparams_bio(BIO *bp, TYPE *a);
int i2d_TYPE_PUBKEY(const TYPE *a, unsigned char **ppout);
int i2d_TYPE_PUBKEY(TYPE *a, unsigned char **ppout);
int i2d_TYPE_PUBKEY_fp(FILE *fp, const TYPE *a);
int i2d_TYPE_PUBKEY_fp(FILE *fp, TYPE *a);
int i2d_TYPE_PUBKEY_bio(BIO *bp, const TYPE *a);
int i2d_TYPE_PUBKEY_bio(BIO *bp, TYPE *a);

💖 DESCRIPTION 💖

first thing, bestie, and I need you to hear me: every single function described here is deprecated. use OSSL_DECODER(3) instead of the d2i functions, and OSSL_ENCODER(3) instead of the i2d functions. the migration deets are down in the Migration section 💅

in all this prose, TYPE is just a placeholder for any of the OpenSSL datatypes, like RSA. and the parameters ppin and ppout? those are generally either both named pp in the headers, or named in and out. slay, consistent queen.

all the functions here behave exactly the way that's described in d2i_X509(3).

real talk though: not all functions in the synopsis exist for all key types. for example, there's no d2i_RSAparams() or i2d_RSAparams(), because the PKCS#1 RSA structure doesn't include any key parameters. it's giving "not applicable, bestie" 😭

here's the full breakdown:

d2i_TYPEPrivateKey() and its derivatives decode DER encoded TYPE private key data organized in a type specific structure.
d2i_TYPEPublicKey() and its derivatives decode DER encoded TYPE public key data organized in a type specific structure.
d2i_TYPEparams() and its derivatives decode DER encoded TYPE key parameters organized in a type specific structure.
d2i_TYPE_PUBKEY() and its derivatives decode DER encoded TYPE public key data organized in a SubjectPublicKeyInfo structure.
i2d_TYPEPrivateKey() and its derivatives encode the private key TYPE data into a type specific DER encoded structure.
i2d_TYPEPublicKey() and its derivatives encode the public key TYPE data into a type specific DER encoded structure.
i2d_TYPEparams() and its derivatives encode the TYPE key parameters data into a type specific DER encoded structure.
i2d_TYPE_PUBKEY() and its derivatives encode the public key TYPE data into a DER encoded SubjectPublicKeyInfo structure.

for example — and this one's iconic — d2i_RSAPrivateKey() and d2i_RSAPublicKey() expect the structure defined by PKCS#1. similarly, i2d_RSAPrivateKey() and i2d_RSAPublicKey() produce DER encoded string organized according to PKCS#1. ✨

🦋 Migration 🦋

so migrating away from the diverse TYPEs requires using the corresponding new OpenSSL types. for all the TYPEs described here, that corresponding new type is EVP_PKEY. and the rest of this section just assumes you already did that — exactly how to do it is described elsewhere, not our problem today 💅

there are two migration paths:

Replace d2i_TYPEPrivateKey() with d2i_PrivateKey(3), d2i_TYPEPublicKey() with d2i_PublicKey(3), d2i_TYPEparams() with d2i_KeyParams(3), d2i_TYPE_PUBKEY() with d2i_PUBKEY(3), i2d_TYPEPrivateKey() with i2d_PrivateKey(3), i2d_TYPEPublicKey() with i2d_PublicKey(3), i2d_TYPEparams() with i2d_KeyParams(3), i2d_TYPE_PUBKEY() with i2d_PUBKEY(3). heads up though: a caveat is that i2d_PrivateKey(3) may output a DER encoded PKCS#8 outermost structure instead of the type specific structure, and that d2i_PrivateKey(3) recognises and unpacks a PKCS#8 structures.
Use OSSL_DECODER(3) and OSSL_ENCODER(3). how to migrate is described below. all those descriptions assume that the key to be encoded is in the variable pkey. 👑

🌈 Migrating i2d functions to OSSL_ENCODER 🌈

the exact OSSL_ENCODER(3) output is driven by arguments rather than by function names. the sample code to get DER encoded output in a type specific structure is uniform — the only things that vary are the selection of what part of the EVP_PKEY should be output, and the structure. so the i2d function names can be translated into two variables, selection and structure, like this:

i2d_TYPEPrivateKey() translates into:

int selection = EVP_PKEY_KEYPAIR;
const char *structure = "type-specific";

i2d_TYPEPublicKey() translates into:

int selection = EVP_PKEY_PUBLIC_KEY;
const char *structure = "type-specific";

i2d_TYPEparams() translates into:

int selection = EVP_PKEY_PARAMETERS;
const char *structure = "type-specific";

i2d_TYPE_PUBKEY() translates into:

int selection = EVP_PKEY_PUBLIC_KEY;
const char *structure = "SubjectPublicKeyInfo";

and the following sample code does the rest of the work 🫶

 unsigned char *p = buffer;     /* |buffer| is supplied by the caller */
 size_t len = buffer_size;      /* assumed be the size of |buffer| */
 OSSL_ENCODER_CTX *ctx =
     OSSL_ENCODER_CTX_new_for_pkey(pkey, selection, "DER", structure,
                                   NULL, NULL);
 if (ctx == NULL) {
     /* fatal error handling */
 }
 if (OSSL_ENCODER_CTX_get_num_encoders(ctx) == 0) {
     OSSL_ENCODER_CTX_free(ctx);
     /* non-fatal error handling */
 }
 if (!OSSL_ENCODER_to_data(ctx, &p, &len)) {
     OSSL_ENCODER_CTX_free(ctx);
     /* error handling */
 }
 OSSL_ENCODER_CTX_free(ctx);

💀 NOTES 💀

the letters i and d in i2d_TYPE() stand for "internal" (that is, an internal C structure) and "DER" respectively. so i2d_TYPE() converts from internal to DER. cute, right?

these functions can also understand BER forms.

the actual TYPE structure passed to i2d_TYPE() must be a valid populated TYPE structure — it cannot simply be fed with an empty structure such as that returned by TYPE_new(). don't do that. it will not slay. 🙈

the encoded data is in binary form and may contain embedded zeros. therefore, any FILE pointers or BIOs should be opened in binary mode. functions such as strlen() will not return the correct length of the encoded structure. no cap, do not use strlen() here.

the ways that *ppin and *ppout are incremented after the operation can trap the unwary. see the WARNINGS section in d2i_X509(3) for some common errors. the reason for this auto-increment behaviour is to reflect a typical usage of ASN1 functions: after one structure is encoded or decoded another will be processed after it.

the following points about the data types might be useful:

DSA_PUBKEY — represents a DSA public key using a SubjectPublicKeyInfo structure.
DSAPublicKey, DSAPrivateKey — use a non-standard OpenSSL format and should be avoided; use DSA_PUBKEY, PEM_write_PrivateKey(3), or similar instead. bestie, leave it in 2020 where it belongs.

🍓 RETURN VALUES 🍓

d2i_TYPE(), d2i_TYPE_bio() and d2i_TYPE_fp() return a valid TYPE structure, or NULL if an error occurs. and if the "reuse" capability has been used with a valid structure being passed in via a, then the object is freed in the event of error and *a is set to NULL. 😭
i2d_TYPE() returns the number of bytes successfully encoded, or a negative value if an error occurs.
i2d_TYPE_bio() and i2d_TYPE_fp() return 1 for success and 0 if an error occurs.

👑 COPYRIGHT 👑

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

aaaand that's the whole page bestie, we ate and left absolutely no crumbs 💅✨ this was OpenSSL 3.5.9, dated 2026-09-29, and it lives under D2I_RSAPRIVATEKEY(3ossl) — now go use OSSL_DECODER(3) and OSSL_ENCODER(3) like the main character you are 🎀💖

📦 where this page comes from

fedora 43: openssl-devel 1:3.5.9-1.fc43 · Apache-2.0
fedora 43: openssl-devel 1:3.5.9-1.fc43 · Apache-2.0
fedora 44: openssl-devel 1:3.5.9-1.fc44 · Apache-2.0
fedora 44: openssl-devel 1:3.5.9-1.fc44 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-14: a language model's rewrite of the original, under its terms