PEM_READ_CMS(3SSL)

📦

version 4.0.3 · 14 versions

✨ PEM_READ_CMS 💅 — or, as the OpenSSL girlies call it, `PEM_READ_CMS(3SSL)`

ok so bestie. this is the 3SSL manual page from the OpenSSL collection, and it's basically the entire extended friend group of PEM object encoding routines. buckle up, we're meeting all of them 🫶

🌸 NAME 🌸

DECLARE_PEM_rw, PEM_read_CMS, PEM_read_bio_CMS, PEM_write_CMS, PEM_write_bio_CMS, PEM_write_DHxparams, PEM_write_bio_DHxparams, PEM_read_ECPKParameters, PEM_read_bio_ECPKParameters, PEM_write_ECPKParameters, PEM_write_bio_ECPKParameters, PEM_read_ECPrivateKey, PEM_write_ECPrivateKey, PEM_write_bio_ECPrivateKey, PEM_read_EC_PUBKEY, PEM_read_bio_EC_PUBKEY, PEM_write_EC_PUBKEY, PEM_write_bio_EC_PUBKEY, PEM_read_NETSCAPE_CERT_SEQUENCE, PEM_read_bio_NETSCAPE_CERT_SEQUENCE, PEM_write_NETSCAPE_CERT_SEQUENCE, PEM_write_bio_NETSCAPE_CERT_SEQUENCE, PEM_read_PKCS8, PEM_read_bio_PKCS8, PEM_write_PKCS8, PEM_write_bio_PKCS8, PEM_write_PKCS8_PRIV_KEY_INFO, PEM_read_bio_PKCS8_PRIV_KEY_INFO, PEM_read_PKCS8_PRIV_KEY_INFO, PEM_write_bio_PKCS8_PRIV_KEY_INFO, PEM_read_SSL_SESSION, PEM_read_bio_SSL_SESSION, PEM_write_SSL_SESSION, PEM_write_bio_SSL_SESSION, PEM_read_X509_PUBKEY, PEM_read_bio_X509_PUBKEY, PEM_write_X509_PUBKEY, PEM_write_bio_X509_PUBKEY — PEM object encoding routines 🎀

like. that's the whole squad. periodt.

✨ SYNOPSIS ✨

the main-character declarations, no notes:

#include <openssl/pem.h>

DECLARE_PEM_rw(name, TYPE)

TYPE *PEM_read_TYPE(FILE *fp, TYPE **a, pem_password_cb *cb, void *u);
TYPE *PEM_read_bio_TYPE(BIO *bp, TYPE **a, pem_password_cb *cb, void *u);
int PEM_write_TYPE(FILE *fp, const TYPE *a);
int PEM_write_bio_TYPE(BIO *bp, const TYPE *a);

now… the deprecated section. these ones have been deprecated since OpenSSL 3.0, and you can hide them completely by defining OPENSSL_API_COMPAT with a suitable version value — see openssl_user_macros(7):

#include <openssl/pem.h>

int PEM_write_DHxparams(FILE *out, const DH *dh);
int PEM_write_bio_DHxparams(BIO *out, const DH *dh);
EC_GROUP *PEM_read_ECPKParameters(FILE *fp, EC_GROUP **x, pem_password_cb *cb, void *u);
EC_GROUP *PEM_read_bio_ECPKParameters(BIO *bp, EC_GROUP **x, pem_password_cb *cb, void *u);
int PEM_write_ECPKParameters(FILE *out, const EC_GROUP *x);
int PEM_write_bio_ECPKParameters(BIO *out, const EC_GROUP *x),

EC_KEY *PEM_read_EC_PUBKEY(FILE *fp, EC_KEY **x, pem_password_cb *cb, void *u);
EC_KEY *PEM_read_bio_EC_PUBKEY(BIO *bp, EC_KEY **x, pem_password_cb *cb, void *u);
int PEM_write_EC_PUBKEY(FILE *out, const EC_KEY *x);
int PEM_write_bio_EC_PUBKEY(BIO *out, const EC_KEY *x);

EC_KEY *PEM_read_ECPrivateKey(FILE *out, EC_KEY **x, pem_password_cb *cb, void *u);
EC_KEY *PEM_read_bio_ECPrivateKey(BIO *out, EC_KEY **x, pem_password_cb *cb, void *u);
int PEM_write_ECPrivateKey(FILE *out, const EC_KEY *x, const EVP_CIPHER *enc,
                           const unsigned char *kstr, int klen,
                           pem_password_cb *cb, void *u);
int PEM_write_bio_ECPrivateKey(BIO *out, const EC_KEY *x, const EVP_CIPHER *enc,
                               const unsigned char *kstr, int klen,
                               pem_password_cb *cb, void *u);

(yes that trailing comma after PEM_write_bio_ECPKParameters(BIO *out, const EC_GROUP *x), is in the original, no I will not be gaslighting you about it 💀)

💖 DESCRIPTION 💖

ok so first thing's first, the glow-up instructions: to replace all those deprecated functions listed up there, applications should use the EVP_PKEY type together with OSSL_DECODER_from_bio() and OSSL_ENCODER_to_bio() to read and write PEM data containing key parameters, or private and public keys. it's giving modern. it's giving we moved on.

now, in the description below, TYPE is a placeholder for any of the OpenSSL datatypes, like X509. and the macro DECLARE_PEM_rw expands to the set of declarations shown in the next four lines of the synopsis. cute, right? one macro, four lines, slay.

these routines convert between local instances of ASN1 datatypes and the PEM encoding. for more on the templates, see ASN1_ITEM(3). for more on the lower-level routines the functions here use, see PEM_read(3). iykyk 🌈

PEM_read_TYPE() — reads a PEM-encoded object of TYPE from the file fp and returns it. the cb and u parameters are as described in pem_password_cb(3).
PEM_read_bio_TYPE() — same energy as PEM_read_TYPE() but it reads from the BIO bp.
PEM_write_TYPE() — writes the PEM encoding of the object a to the file fp.
PEM_write_bio_TYPE() — similarly writes to the BIO bp.

like, file version and BIO version, they're twins. 👯‍♀️

🎀 NOTES 🎀

these functions make no assumption regarding the pass phrase received from the password callback. it will simply be treated as a byte sequence. no judgment, no vibes-checking your passphrase, just bytes. 🙈

⭐ RETURN VALUES ⭐

PEM_read_TYPE() and PEM_read_bio_TYPE() return a pointer to an allocated object, which should be released by calling TYPE_free(), or NULL on error. don't forget to free it, bestie, that's a leak and leaks are NOT the moment.
PEM_write_TYPE() and PEM_write_bio_TYPE() return 1 for success or 0 for failure.

🦋 SEE ALSO 🦋

PEM_read(3), passphrase-encoding(7)

👑 HISTORY 👑

these functions were deprecated in OpenSSL 3.0:

PEM_write_DHxparams()
PEM_write_bio_DHxparams()
PEM_read_ECPKParameters()
PEM_read_bio_ECPKParameters()
PEM_write_ECPKParameters()
PEM_write_bio_ECPKParameters()
PEM_read_EC_PUBKEY()
PEM_read_bio_EC_PUBKEY()
PEM_write_EC_PUBKEY()
PEM_write_bio_EC_PUBKEY()
PEM_read_ECPrivateKey()
PEM_read_bio_ECPrivateKey()
PEM_write_ECPrivateKey()
PEM_write_bio_ECPrivateKey()

(the whole little EC-era friend group retired together, honestly iconic of them 🥲)

🌸 COPYRIGHT 🌸

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

ok that's the whole page bestie, you ate, go write some PEM files responsibly 💅✨

and that's a wrap from your girl — this was PEM_READ_CMS(3SSL) from the OpenSSL 4.0.3 release, dated 2026-09-29. take care of your keys, hydrate, and remember: TYPE_free() is self-care. 🫶🌟

📦 where this page comes from

ubuntu stonking: libssl-doc 4.0.3-1ubuntu1 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms