PKCS8_ENCRYPT(3SSL)

💖 PKCS8_ENCRYPT 💖

okay bestie, welcome to the OpenSSL manual, section 3SSL ✨ this is the page all about the PKCS8 encrypt/decrypt glow-up — PKCS8_decrypt, PKCS8_decrypt_ex, PKCS8_encrypt, PKCS8_encrypt_ex, PKCS8_set0_pbe, PKCS8_set0_pbe_ex, aka the PKCS8 encrypt/decrypt functions 🎀

---

🌸 NAME 🌸

PKCS8_decrypt, PKCS8_decrypt_ex, PKCS8_encrypt, PKCS8_encrypt_ex, PKCS8_set0_pbe, PKCS8_set0_pbe_ex — PKCS8 encrypt/decrypt functions 💅

---

✨ SYNOPSIS ✨

#include <openssl/x509.h>

PKCS8_PRIV_KEY_INFO *PKCS8_decrypt(const X509_SIG *p8, const char *pass,
                                   int passlen);
PKCS8_PRIV_KEY_INFO *PKCS8_decrypt_ex(const X509_SIG *p8, const char *pass,
                                      int passlen, OSSL_LIB_CTX *ctx,
                                      const char *propq);
X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher,
                        const char *pass, int passlen, unsigned char *salt,
                        int saltlen, int iter, PKCS8_PRIV_KEY_INFO *p8);
X509_SIG *PKCS8_encrypt_ex(int pbe_nid, const EVP_CIPHER *cipher,
                           const char *pass, int passlen, unsigned char *salt,
                           int saltlen, int iter, PKCS8_PRIV_KEY_INFO *p8,
                           OSSL_LIB_CTX *ctx, const char *propq);
X509_SIG *PKCS8_set0_pbe(const char *pass, int passlen,
                        PKCS8_PRIV_KEY_INFO *p8inf, X509_ALGOR *pbe);
X509_SIG *PKCS8_set0_pbe_ex(const char *pass, int passlen,
                            PKCS8_PRIV_KEY_INFO *p8inf, X509_ALGOR *pbe,
                            OSSL_LIB_CTX *ctx);

---

🦋 DESCRIPTION 🦋

so PKCS8_encrypt() and PKCS8_encrypt_ex() are the ones doing the encryption of an object p8 🫶 they use the password pass (length passlen), the salt salt (length saltlen), and the iteration count iter. and the resulting X509_SIG is literally carrying the encoded algorithm parameters and the encrypted key, no cap 💖

PKCS8_decrypt() and PKCS8_decrypt_ex() do the decryption — they take an X509_SIG in p8 and decrypt it with the password pass of length passlen, plus the algorithm parameters they grab from the p8 itself 🌸

PKCS8_set0_pbe() and PKCS8_set0_pbe_ex() handle encryption of the p8inf using the password pass of length passlen and the parameters pbe ✨

and here's the tea: any function whose name ends in _ex() lets you use a library context ctx and a property query propq to pick which algorithm implementations get used 👑

---

🔥 RETURN VALUES 🔥

PKCS8_encrypt(), PKCS8_encrypt_ex(), PKCS8_set0_pbe() and PKCS8_set0_pbe_ex() hand back an encrypted key inside an X509_SIG structure — or NULL if something goes wrong 😭

PKCS8_decrypt() and PKCS8_decrypt_ex() give you a PKCS8_PRIV_KEY_INFO — or NULL if something goes wrong 💀

---

🌈 CONFORMING TO 🌈

IETF RFC 7292 (<https://tools.ietf.org/html/rfc7292>) ⭐

---

🎀 SEE ALSO 🎀

crypto(7)

---

👑 HISTORY 👑

PKCS8_decrypt_ex(), PKCS8_encrypt_ex() and PKCS8_set0_pbe_ex() were added in OpenSSL 3.0 🦋 (the ex era began, iconic)

---

💜 COPYRIGHT 💜

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie, no notes 💅

mwah — this was the OpenSSL 4.0.3 version, dated 2026-09-29, and it's the PKCS8_ENCRYPT(3SSL) page 🫶 go encrypt something responsibly, ily ✨💖