PKCS12_ADD_CERT(3SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

✨ PKCS12_ADD_CERT ✨

okay bestie, pull up a chair 🫶 because today we're talking about PKCS12_ADD_CERT(3SSL) — that's the 3SSL manual page, and it's literally your one-stop shop for stuffing objects into a set of PKCS#12 safeBags. no cap.

Four little icons live here and they all do the same general vibe: make a fresh PKCS12_SAFEBAG and yeet it into the stack. Let's meet them 💅

  • PKCS12_add_cert
  • PKCS12_add_key
  • PKCS12_add_key_ex
  • PKCS12_add_secret

🌸 SYNOPSIS 🌸

manifesting the includes first, as always:

#include <openssl/pkcs12.h>

PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert);
PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags,
                              EVP_PKEY *key, int key_usage, int iter,
                              int key_nid, const char *pass);
PKCS12_SAFEBAG *PKCS12_add_key_ex(STACK_OF(PKCS12_SAFEBAG) **pbags,
                                  EVP_PKEY *key, int key_usage, int iter,
                                  int key_nid, const char *pass,
                                  OSSL_LIB_CTX *ctx, const char *propq);

PKCS12_SAFEBAG *PKCS12_add_secret(STACK_OF(PKCS12_SAFEBAG) **pbags,
                                 int nid_type, const unsigned char *value, int len);

💖 DESCRIPTION 💖

so the whole friend group here does one thing: they create a new PKCS12_SAFEBAG and add it to the set of safeBags in pbags. that's the assignment and they ate 🔥

  • PKCS12_add_cert() — makes a PKCS#12 certBag holding the certificate you handed it (cert), then adds it to the set of PKCS#12 safeBags. cute, simple, iconic.
  • PKCS12_add_key() — makes either a PKCS#12 keyBag that's unencrypted, or a pkcs8shroudedKeyBag that's encrypted, holding the EVP_PKEY you gave it, and adds it to the set of PKCS#12 safeBags. If key_nid is not -1 then the key gets encrypted with the supplied algorithm, using pass as the passphrase and iter as the iteration count. and here's the little detail you don't wanna miss: if iter is zero, then a default value for iteration count of 2048 is used. periodt.
  • PKCS12_add_key_ex() — literally identical to PKCS12_add_key() except it also lets a library context ctx and a property query propq be used to select algorithm implementations. same energy, more knobs 💅
  • PKCS12_add_secret() — makes a PKCS#12 secretBag with an OID that corresponds to the supplied nid_type, containing the supplied value as an ASN1 octet string. then it gets added to the set of PKCS#12 safeBags. slay.

🦋 NOTES 🦋

If a certificate contains an alias or a keyid, then this will be used for the corresponding friendlyName or localKeyID in the PKCS12 structure. it just knows 🫶

ngl, PKCS12_add_key() makes assumptions regarding the encoding of the given pass phrase. go read passphrase-encoding(7) for more info — don't skip this part bestie, it matters.

⭐ RETURN VALUES ⭐

You get back a valid PKCS12_SAFEBAG structure, or NULL if an error occurred. that's it, that's the whole vibe check 😭

💜 CONFORMING TO 💜

IETF RFC 7292 (<https://tools.ietf.org/html/rfc7292>)

🎀 SEE ALSO 🎀

iykyk 👑

🌈 HISTORY 🌈

PKCS12_add_secret() and PKCS12_add_key_ex() were added in OpenSSL 3.0. so if you're on something older, they're simply not in the group chat yet 🙈

Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's a wrap on PKCS12_ADD_CERT(3SSL), from OpenSSL version 4.0.3, dated 2026-09-29 ✨ take care of those safeBags bestie, mwah 💖🎀🦋

📦 where this page comes from