CMS_GET0_SIGNERINFOS(3SSL)

💅 CMS_GET0_SIGNERINFOS 💅

okay bestie, this is the OpenSSL page for the CMS signedData signer functions — that's manual section 3SSL btw, so you're in the right place 🫶

The girlies we're covering: CMS_SignerInfo_set1_signer_cert, CMS_get0_SignerInfos, CMS_SignerInfo_get0_signer_id, CMS_SignerInfo_get0_signature, and CMS_SignerInfo_cert_cmp. They're all about poking at the signers inside a CMS signedData thing. 👑

---

✨ SYNOPSIS ✨

#include <openssl/cms.h>

STACK_OF(CMS_SignerInfo) *CMS_get0_SignerInfos(CMS_ContentInfo *cms);

int CMS_SignerInfo_get0_signer_id(CMS_SignerInfo *si, ASN1_OCTET_STRING **keyid,
                                  X509_NAME **issuer, ASN1_INTEGER **sno);
ASN1_OCTET_STRING *CMS_SignerInfo_get0_signature(CMS_SignerInfo *si);
int CMS_SignerInfo_cert_cmp(CMS_SignerInfo *si, X509 *cert);
void CMS_SignerInfo_set1_signer_cert(CMS_SignerInfo *si, X509 *signer);

---

🌸 DESCRIPTION 🌸

CMS_get0_SignerInfos() — this one hands you all the CMS_SignerInfo structures chillin' inside a CMS signedData structure. all of them. the whole squad. 🫂

CMS_SignerInfo_get0_signer_id() — retrieves the certificate signer identifier that goes with a specific CMS_SignerInfo structure, aka si. And it's an either/or situation, so pay attention: either the keyidentifier gets set in keyid, or both the issuer name and the serial number land in issuer and sno. 🔑

CMS_SignerInfo_get0_signature() — grabs the signature linked to si and gives it to you as a pointer to an ASN1_OCTET_STRING structure. and here's the tea: that returned pointer corresponds to the internal signature value if si, so you can read it or modify it. it's giving direct access, no middleman 💅

CMS_SignerInfo_cert_cmp() — compares the certificate cert against the signer identifier si. returns zero if the comparison slays (successful) and non zero if it doesn't. 😭

CMS_SignerInfo_set1_signer_cert() — sets the signer's certificate of si to signer. that's it, that's the whole job. ✨

---

📝 NOTES 📝

The main purpose of these functions? To let an application look up signers' certificates using any appropriate technique — for when the simpler method of CMS_verify() just isn't appropriate. sometimes you gotta do it yourself, bestie. 💁‍♀️

In typical usage and application will retrieve all CMS_SignerInfo structures using CMS_get0_SignerInfo() and retrieve the identifier information using CMS. It will then obtain the signer certificate by some unspecified means (or return and error if it cannot be found) and set it using CMS_SignerInfo_set1_signer_cert().

Once all signer certificates have been set, CMS_verify() can be used. 🎀

okay so real talk — CMS_get0_SignerInfos() can return NULL if an error occurs or if there are no signers at all. But ngl this isn't actually a problem in practice, because the only error that can occur is if the cms structure is not of type signedData, and that'd be due to an application error. so like, it's a you problem at that point 🙈

---

🦋 RETURN VALUES 🦋

• CMS_get0_SignerInfos() returns all CMS_SignerInfo structures, or NULL there are no signers or an error occurs.
• CMS_SignerInfo_get0_signer_id() returns 1 for success and 0 for failure.
• CMS_SignerInfo_cert_cmp() returns 0 for a successful comparison and non zero otherwise.
• CMS_SignerInfo_set1_signer_cert() does not return a value.

Any error can be obtained from ERR_get_error(3) 🫶

---

👑 SEE ALSO 👑

ERR_get_error(3), CMS_verify(3)

---

⭐ COPYRIGHT ⭐

Copyright 2008-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie!! 💖 this little baddie is 4.0.3, dated 2026-09-29, from the OpenSSL girlies themselves. go forth and look up those signer certificates, no cap 🌈💜