CMS_ADD0_CERT(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

💅 CMS_ADD0_CERT ✨

okay so bestie, you're in the CMS_ADD0_CERT(3SSL) page from OpenSSL, and it's literally the group chat of "how do I add certs and CRLs to my CMS thing" 🎀 six little functions, one very demure job: stuffing certificates and CRLs into a CMS_ContentInfo struct. let's get into it 🫶

🌸 NAME 🌸

CMS_add0_cert, CMS_add1_cert, CMS_get1_certs, CMS_add0_crl, CMS_add1_crl, CMS_get1_crls — the CMS certificate and CRL utility functions. they're giving "housekeeping squad for your CMS message" 💖

✨ SYNOPSIS ✨

#include <openssl/cms.h>

int CMS_add0_cert(CMS_ContentInfo *cms, X509 *cert);
int CMS_add1_cert(CMS_ContentInfo *cms, X509 *cert);
STACK_OF(X509) *CMS_get1_certs(CMS_ContentInfo *cms);

int CMS_add0_crl(CMS_ContentInfo *cms, X509_CRL *crl);
int CMS_add1_crl(CMS_ContentInfo *cms, X509_CRL *crl);
STACK_OF(X509_CRL) *CMS_get1_crls(CMS_ContentInfo *cms);

🦋 DESCRIPTION 🦋

CMS_add0_cert() and CMS_add1_cert() add the certificate cert to cms — unless it's already there, because we do NOT do duplicates in this house 💅. this is the thing CMS_sign_ex(3) and CMS_sign(3) use under the hood, and you can also call it yourself before CMS_verify(3) to help with chain building during certificate validation. like, giving verify a lil assist, yk? 🫶

the 0 in CMS_add0_cert() is doing the most important job, bestie — it means the cert is added internally to cms, and on success the caller must NOT free it 😭. meanwhile the caller of CMS_add1_cert() must free cert themselves. mind the difference, it's giving memory-leak-if-you-forget energy 💀

cms has to be of type signed data or (authenticated) enveloped data or it's not gonna vibe. for signed data, that certificate can be used when signing or verifying to fill in the signer certificate, or to hand over an extra CA certificate that might be needed for chain building in certificate validation. yes, it's that girl 👑

CMS_get1_certs() returns all certificates in cms. all of them. the whole collection. periodt ✨

CMS_add0_crl() and CMS_add1_crl() add the CRL crl to cms. again, cms must be of type signed data or (authenticated) enveloped data. for signed data, such a CRL may be used in certificate validation with CMS_verify(3). and here's the cute part: it may be given both for inclusion when signing a CMS message and when verifying a signed CMS message. versatile icon 🌈

CMS_get1_crls() returns all CRLs in cms 🎀

💜 NOTES 💜

the CMS_ContentInfo structure cms must be of type signed data, enveloped data, or authenticated enveloped data — otherwise an error gets returned. no exceptions, no negotiation, vibe check failed 💀

for signed data, certificates and CRLs get added to the certificates and crls fields of the SignedData structure. for enveloped data, they go into OriginatorInfo instead. just so you know where they're chilling 🏠

⭐ RETURN VALUES ⭐

CMS_add0_cert(), CMS_add1_cert(), CMS_add0_crl() and CMS_add1_crl() return 1 for success and 0 for failure. that's the whole rubric 🎯

CMS_get1_certs() and CMS_get1_crls() return the STACK of certificates or CRLs — or NULL if there are none, or if an error happens. and ngl, besides out-of-memory, the only error you'll see in practice is the cms type being invalid. so if it's being weird, check your type first, bestie 🙈

🔥 SEE ALSO 🔥

👑 HISTORY 👑

CMS_add0_cert() and CMS_add1_cert() have been changed in OpenSSL 3.2 not to throw an error if a certificate to be added is already present. so if you were stressed about double-adding, breathe, they fixed it 🫶

Copyright 2008-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 💖 mwah 💋 this was OpenSSL 4.0.3, dated 2026-09-29, and we were all up in CMS_ADD0_CERT(3SSL) — go forth and add your certs responsibly, and remember to free the add1 ones 🌸✨

📦 where this page comes from