PKCS12_SAFEBAG_CREATE_CERT(3SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 NAME 💖

okay bestie, so these are the girlies that make PKCS#12 safeBag objects for you:

  • PKCS12_SAFEBAG_create_cert
  • PKCS12_SAFEBAG_create_crl
  • PKCS12_SAFEBAG_create_secret
  • PKCS12_SAFEBAG_create0_p8inf
  • PKCS12_SAFEBAG_create0_pkcs8
  • PKCS12_SAFEBAG_create_pkcs8_encrypt
  • PKCS12_SAFEBAG_create_pkcs8_encrypt_ex

like. they literally build safeBags. that's the whole job. this is part of the OpenSSL 3SSL manual set, and honestly? iconic behavior 🎀

✨ SYNOPSIS ✨

#include <openssl/pkcs12.h>

PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_cert(X509 *x509);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_crl(X509_CRL *crl);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_secret(int type, int vtype,
                                             const unsigned char* value,
                                             int len);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create0_p8inf(PKCS8_PRIV_KEY_INFO *p8);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create0_pkcs8(X509_SIG *p8);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_pkcs8_encrypt(int pbe_nid,
                                                    const char *pass,
                                                    int passlen,
                                                    unsigned char *salt,
                                                    int saltlen, int iter,
                                                    PKCS8_PRIV_KEY_INFO *p8inf);
PKCS12_SAFEBAG *PKCS12_SAFEBAG_create_pkcs8_encrypt_ex(int pbe_nid,
                                                       const char *pass,
                                                       int passlen,
                                                       unsigned char *salt,
                                                       int saltlen, int iter,
                                                       PKCS8_PRIV_KEY_INFO *p8inf,
                                                       OSSL_LIB_CTX *ctx,
                                                       const char *propq);

slay. seven functions, one header, zero notes. let's get into it 💅

🦋 DESCRIPTION 🦋

okay so here's the vibe check on every single one, no skips, no cap:

  • PKCS12_SAFEBAG_create_cert() — makes you a brand new PKCS12_SAFEBAG of type NID_certBag, and it's holding the certificate you handed it. your cert? wrapped. periodt.
  • PKCS12_SAFEBAG_create_crl() — same energy, different bag: a new PKCS12_SAFEBAG of type NID_crlBag, carrying the crl you gave it. revocation lists deserve cute packaging too, fr fr.
  • PKCS12_SAFEBAG_create_secret() — builds a new PKCS12_SAFEBAG of the type that corresponds to a PKCS#12 secretBag. the secretBag contents are tagged as type, with an ASN1 value of type vtype constructed out of the bytes in value, which is len bytes long. little secret, big energy 🙈
  • PKCS12_SAFEBAG_create0_p8inf() — new PKCS12_SAFEBAG, type NID_keyBag, containing the PKCS8 structure you passed in. straight in, no encryption, we're feeling brave.
  • PKCS12_SAFEBAG_create0_pkcs8() — new PKCS12_SAFEBAG, type NID_pkcs8ShroudedKeyBag, containing the supplied PKCS8 structure.
  • PKCS12_SAFEBAG_create_pkcs8_encrypt() — creates a new PKCS12_SAFEBAG of type NID_pkcs8ShroudedKeyBag by encrypting the supplied PKCS8 p8inf. the deets:
    • if pbe_nid is 0, a default encryption algorithm is used. default queen behavior 👑
    • pass is the passphrase and iter is the iteration count.
    • if iter is zero, a default value of 2048 is used.
    • if salt is NULL, then a salt is generated randomly. let the chaos pick ✨
  • PKCS12_SAFEBAG_create_pkcs8_encrypt_ex() — literally identical to PKCS12_SAFEBAG_create_pkcs8_encrypt(), except it also lets you pass a library context ctx and a property query propq, which get used to select algorithm implementations. same function, more control, main character energy 💜

🌸 NOTES 🌸

okay important one, bestie, don't scroll past this: PKCS12_SAFEBAG_create_pkcs8_encrypt() makes assumptions regarding the encoding of the given pass phrase. so go read passphrase-encoding(7) for the full tea before you come for me.

also: PKCS12_SAFEBAG_create_secret() was added in OpenSSL 3.0. so if you're on something older, it's giving "not invited to the party" 😭

⭐ RETURN VALUES ⭐

all of these functions return a valid PKCS12_SAFEBAG structure… or NULL if an error occurred. that's it, that's the whole return story. NULL is the "we don't talk about it" of return values 💀

🌈 CONFORMING TO 🌈

IETF RFC 7292 (<https://tools.ietf.org/html/rfc7292>) — yes we're standards-compliant and yes we're cute about it.

🫶 SEE ALSO 🫶

go read those when you're done here, they're the extended universe iykyk

🧚 HISTORY 🧚

PKCS12_SAFEBAG_create_pkcs8_encrypt_ex() was added in OpenSSL 3.0. glow-up era, truly.

Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 🎀 this was OpenSSL version 4.0.3, dated 2026-09-29, from the PKCS12_SAFEBAG_CREATE_CERT(3SSL) manual — go forth and bag those safes, mwah 💖✨

📦 where this page comes from