PKCS12_ITEM_DECRYPT_D2I(3SSL)

💖 PKCS12_ITEM_DECRYPT_D2I 💖

okay so bestie, welcome to the PKCS12_ITEM_DECRYPT_D2I(3SSL) page 🎀 this is the OpenSSL manual for the PKCS12 item encrypt/decrypt functions, and no cap, it's lowkey adorable how short it is. let's get into it ✨

✨ NAME ✨

PKCS12_item_decrypt_d2i, PKCS12_item_decrypt_d2i_ex, PKCS12_item_i2d_encrypt, PKCS12_item_i2d_encrypt_ex — PKCS12 item encrypt/decrypt functions 🦋

---

🌸 SYNOPSIS 🌸

#include <openssl/pkcs12.h>

void *PKCS12_item_decrypt_d2i(const X509_ALGOR *algor, const ASN1_ITEM *it,
                              const char *pass, int passlen,
                              const ASN1_OCTET_STRING *oct, int zbuf);
void *PKCS12_item_decrypt_d2i_ex(const X509_ALGOR *algor, const ASN1_ITEM *it,
                                 const char *pass, int passlen,
                                 const ASN1_OCTET_STRING *oct, int zbuf,
                                 OSSL_LIB_CTX *libctx,
                                 const char *propq);
ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt(X509_ALGOR *algor,
                                           const ASN1_ITEM *it,
                                           const char *pass, int passlen,
                                           void *obj, int zbuf);
ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt_ex(X509_ALGOR *algor,
                                              const ASN1_ITEM *it,
                                              const char *pass, int passlen,
                                              void *obj, int zbuf,
                                              OSSL_LIB_CTX *ctx,
                                              const char *propq);

---

🧚 DESCRIPTION 🧚

PKCS12_item_decrypt_d2i() and PKCS12_item_decrypt_d2i_ex() decrypt an octet string that's holding an ASN.1 encoded object 💅 they do it using the algorithm algor and password pass with length passlen. and if zbuf is nonzero?? the output buffer gets zeroed after the decrypt, periodt 🧼

PKCS12_item_i2d_encrypt() and PKCS12_item_i2d_encrypt_ex() go the other way — they encrypt an ASN.1 object it using the algorithm algor and password pass of length passlen, and they return an encoded object in obj 💖 and again, if zbuf is nonzero, the buffer holding the input encoding gets zeroed after the encrypt. clean up after yourself, bestie 🧽✨

also!! the functions ending in _ex() let you use a library context ctx and a property query propq to pick which algorithm implementations get used — it's giving choose-your-own-adventure but for crypto providers 👑

---

👑 RETURN VALUES 👑

PKCS12_item_decrypt_d2i() and PKCS12_item_decrypt_d2i_ex() hand you back the decrypted object, or NULL if something went wrong 😭

PKCS12_item_i2d_encrypt() and PKCS12_item_i2d_encrypt_ex() return the encrypted data as an ASN.1 Octet String, or NULL if an error occurred 💀

---

🔥 SEE ALSO 🔥

PKCS12_pbe_crypt_ex(3), PKCS8_encrypt_ex(3) — go read these next, iykyk 📚

---

🌈 HISTORY 🌈

PKCS12_item_decrypt_d2i_ex() and PKCS12_item_i2d_encrypt_ex() were added in OpenSSL 3.0 ⭐ so if you're on something older, sorry bestie, those ones aren't invited to the party 🙈

---

🎀 COPYRIGHT 🎀

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, angel 💜 this was OpenSSL 4.0.3, dated 2026-09-29, and you were reading the PKCS12_ITEM_DECRYPT_D2I(3SSL) manual. slay, go encrypt something responsibly 🫶💅✨