CMS_GET0_SIGNERINFOS(3ssl)

💅 CMS_GET0_SIGNERINFOS — the OpenSSL 3ssl manual, bestie edition 🎀

okay so this is the 3ssl manual page for the CMS signedData signer functions, and honestly? it's giving "backstage pass to how signatures actually get checked" ✨

🌸 NAME 🌸

CMS_SignerInfo_set1_signer_cert, CMS_SignerInfo_get0_signer_cert, CMS_get0_SignerInfos, CMS_SignerInfo_get0_signer_id, CMS_SignerInfo_get0_signature, CMS_SignerInfo_cert_cmp, CMS_SignerInfo_get_verification_result — the CMS signedData signer functions, aka the whole squad 💖

✨ SYNOPSIS ✨

#include <openssl/cms.h>

STACK_OF(CMS_SignerInfo) *CMS_get0_SignerInfos(CMS_ContentInfo *cms);

int CMS_SignerInfo_get0_signer_id(CMS_SignerInfo *si, ASN1_OCTET_STRING **keyid,
                                  X509_NAME **issuer, ASN1_INTEGER **sno);
ASN1_OCTET_STRING *CMS_SignerInfo_get0_signature(CMS_SignerInfo *si);
int CMS_SignerInfo_cert_cmp(CMS_SignerInfo *si, X509 *cert);
void CMS_SignerInfo_set1_signer_cert(CMS_SignerInfo *si, X509 *signer);
X509 *CMS_SignerInfo_get0_signer_cert(CMS_SignerInfo *si);
int CMS_SignerInfo_get_verification_result(CMS_SignerInfo *si, int type);

💜 DESCRIPTION 💜

So here's the tea on each one 🍓

• CMS_get0_SignerInfos() — hands you all the CMS_SignerInfo structures chillin' inside a CMS signedData structure. the whole group chat, no cap.
• CMS_SignerInfo_get0_signer_id() — digs out the certificate signer identifier for one specific CMS_SignerInfo structure, si. and it's literally one or the other: either the keyidentifier gets set in keyid, or both the issuer name and serial number get set in issuer and sno. iykyk 🦋
• CMS_SignerInfo_get0_signature() — pulls the signature for si and gives it to you as a pointer to an ASN1_OCTET_STRING structure. and the plot twist? that pointer is the internal signature value of si, so you can read it or modify it. main character pointer energy tbh 👑
• CMS_SignerInfo_cert_cmp() — compares the certificate cert against the signer identifier si. returns zero if the comparison slays (successful), non-zero if not. periodt.
• CMS_SignerInfo_set1_signer_cert() — sets the signer's certificate of si to signer. simple, iconic, done.
• CMS_SignerInfo_get0_signer_cert() — returns the signer's certificate associated with si. ⚠️ and listen: this pointer should not be freed by the caller. don't do it. not you. 🙈
• CMS_SignerInfo_get_verification_result() — tells you whether one specific aspect of the signature verification worked, after you've called CMS_verify(3) with the flag CMS_VERIFY_PARTIAL. the type you pass decides the vibe check:
  • CMS_VERIFY_RESULT → the overall result 🔥
  • CMS_VERIFY_CERT → certificate verification
  • CMS_VERIFY_ATTR → attribute verification
  • CMS_VERIFY_CONTENT → content verification

---

🧚 NOTES 🧚

the whole point of these functions is letting your app look up signer certificates using whatever technique fits, for when the simpler CMS_verify() route isn't the move. 💅

typical usage goes like this: the application retrieves all the CMS_SignerInfo structures using CMS_get0_SignerInfo(), gets the identifier info using CMS. then it obtains the signer certificate by some unspecified means (or returns an error if it can't find it) and sets it with CMS_SignerInfo_set1_signer_cert(). 🌈

once all the signer certificates are set, CMS_verify() can be used. slay. ✨

and yeah — CMS_get0_SignerInfos() can return NULL if an error occurs or if there are no signers, but in practice that's not a problem, because the only error that can happen is the cms structure not being of type signedData, which is an application error. so like, if that happens, it's on you bestie 😭

🌟 RETURN VALUES 🌟

• CMS_get0_SignerInfos() — returns all CMS_SignerInfo structures, or NULL if there are no signers or an error occurs.
• CMS_SignerInfo_get0_signer_id() — returns 1 for success and 0 for failure.
• CMS_SignerInfo_cert_cmp() — returns 0 for a successful comparison and non zero otherwise.
• CMS_SignerInfo_set1_signer_cert() — does not return a value. it's above returning things, honestly.
• any error can be obtained from ERR_get_error(3).

🦋 SEE ALSO 🦋

ERR_get_error(3), CMS_verify(3)

⭐ HISTORY ⭐

CMS_SignerInfo_get0_signer_cert and CMS_SignerInfo_get_verification_result were added in OpenSSL 4.1. new arrivals, and they ate 💖

🎀 COPYRIGHT 🎀

Copyright 2008-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the page!! brought to you by OpenSSL 4.1.0, dated 2026-10-23 — the CMS_GET0_SIGNERINFOS(3ssl) manual, rewritten with love, glitter, and zero lost details 🫶💜🌸