PEM_write_bio_PKCS8PrivateKey
,
PEM_write_PKCS8PrivateKey
,
PEM_write_bio_PKCS8PrivateKey_nid
,
PEM_write_PKCS8PrivateKey_nid
,
PEM_read_bio_PKCS8
,
PEM_read_PKCS8
,
PEM_write_bio_PKCS8
,
PEM_write_PKCS8
,
PEM_read_bio_PKCS8_PRIV_KEY_INFO
,
PEM_read_PKCS8_PRIV_KEY_INFO
,
PEM_write_bio_PKCS8_PRIV_KEY_INFO
,
PEM_write_PKCS8_PRIV_KEY_INFO
,
PEM_read_bio_PUBKEY
,
PEM_read_PUBKEY
,
PEM_write_bio_PUBKEY
,
PEM_write_PUBKEY
,
PEM_read_bio_RSAPrivateKey
,
PEM_read_RSAPrivateKey
,
PEM_write_bio_RSAPrivateKey
,
PEM_write_RSAPrivateKey
,
PEM_read_bio_RSAPublicKey
,
PEM_read_RSAPublicKey
,
PEM_write_bio_RSAPublicKey
,
PEM_write_RSAPublicKey
,
PEM_read_bio_RSA_PUBKEY
,
PEM_read_RSA_PUBKEY
,
PEM_write_bio_RSA_PUBKEY
,
PEM_write_RSA_PUBKEY
,
PEM_read_bio_DSAPrivateKey
,
PEM_read_DSAPrivateKey
,
PEM_write_bio_DSAPrivateKey
,
PEM_write_DSAPrivateKey
,
PEM_read_bio_DSA_PUBKEY
,
PEM_read_DSA_PUBKEY
,
PEM_write_bio_DSA_PUBKEY
,
PEM_write_DSA_PUBKEY
,
PEM_read_bio_DSAparams
,
PEM_read_DSAparams
,
PEM_write_bio_DSAparams
,
PEM_write_DSAparams
,
PEM_read_bio_DHparams
,
PEM_read_DHparams
,
PEM_write_bio_DHparams
,
PEM_write_DHparams
,
PEM_read_bio_ECPKParameters
,
PEM_read_ECPKParameters
,
PEM_write_bio_ECPKParameters
,
PEM_write_ECPKParameters
,
PEM_read_bio_ECPrivateKey
,
PEM_read_ECPrivateKey
,
PEM_write_bio_ECPrivateKey
,
PEM_write_ECPrivateKey
,
PEM_read_bio_EC_PUBKEY
,
PEM_read_EC_PUBKEY
,
PEM_write_bio_EC_PUBKEY
,
PEM_write_EC_PUBKEY
,
PEM_read_bio_X509
,
PEM_read_X509
,
PEM_write_bio_X509
,
PEM_write_X509
,
PEM_read_bio_X509_AUX
,
PEM_read_X509_AUX
,
PEM_write_bio_X509_AUX
,
PEM_write_X509_AUX
,
PEM_read_bio_X509_REQ
,
PEM_read_X509_REQ
,
PEM_write_bio_X509_REQ
,
PEM_write_X509_REQ
,
PEM_write_bio_X509_REQ_NEW
,
PEM_write_X509_REQ_NEW
,
PEM_read_bio_X509_CRL
,
PEM_read_X509_CRL
,
PEM_write_bio_X509_CRL
,
PEM_write_X509_CRL
,
PEM_read_bio_PKCS7
,
PEM_read_PKCS7
,
PEM_write_bio_PKCS7
,
PEM_write_PKCS7
,
PEM_read_CMS
,
PEM_read_bio_CMS
,
PEM_write_CMS
,
PEM_write_bio_CMS
—
PEM routines
#include
<
openssl/pem.h
>
EVP_PKEY *
PEM_read_bio_PrivateKey
(
BIO *bp
,
EVP_PKEY **x
,
pem_password_cb
*cb
,
void *u
);
EVP_PKEY *
PEM_read_PrivateKey
(
FILE *fp
,
EVP_PKEY **x
,
pem_password_cb
*cb
,
void *u
);
PEM_write_bio_PrivateKey
(
BIO
*bp
,
EVP_PKEY *x
,
const
EVP_CIPHER *enc
,
unsigned char *kstr
,
int klen
,
pem_password_cb *cb
,
void *u
);
PEM_write_PrivateKey
(
FILE *fp
,
EVP_PKEY *x
,
const EVP_CIPHER
*enc
,
unsigned char *kstr
,
int
klen
,
pem_password_cb *cb
,
void
*u
);
PEM_write_bio_PKCS8PrivateKey
(
BIO
*bp
,
EVP_PKEY *x
,
const
EVP_CIPHER *enc
,
char *kstr
,
int
klen
,
pem_password_cb *cb
,
void
*u
);
PEM_write_PKCS8PrivateKey
(
FILE
*fp
,
EVP_PKEY *x
,
const
EVP_CIPHER *enc
,
char *kstr
,
int
klen
,
pem_password_cb *cb
,
void
*u
);
PEM_write_bio_PKCS8PrivateKey_nid
(
BIO
*bp
,
EVP_PKEY *x
,
int nid
,
char *kstr
,
int klen
,
pem_password_cb *cb
,
void
*u
);
PEM_write_PKCS8PrivateKey_nid
(
FILE
*fp
,
EVP_PKEY *x
,
int nid
,
char *kstr
,
int klen
,
pem_password_cb *cb
,
void
*u
);
X509_SIG *
PEM_read_bio_PKCS8
(
BIO *bp
,
X509_SIG **x
,
pem_password_cb
*cb
,
void *u
);
X509_SIG *
PEM_read_PKCS8
(
FILE *fp
,
X509_SIG **x
,
pem_password_cb
*cb
,
void *u
);
PEM_write_bio_PKCS8
(
BIO *bp
,
X509_SIG *x
);
PEM_write_PKCS8
(
FILE *fp
,
X509_SIG *x
);
PKCS8_PRIV_KEY_INFO *
PEM_read_bio_PKCS8_PRIV_KEY_INFO
(
BIO
*bp
,
PKCS8_PRIV_KEY_INFO **x
,
pem_password_cb *cb
,
void
*u
);
PKCS8_PRIV_KEY_INFO *
PEM_read_PKCS8_PRIV_KEY_INFO
(
FILE
*fp
,
PKCS8_PRIV_KEY_INFO **x
,
pem_password_cb *cb
,
void
*u
);
PEM_write_bio_PKCS8_PRIV_KEY_INFO
(
BIO
*bp
,
PKCS8_PRIV_KEY_INFO *x
);
PEM_write_PKCS8_PRIV_KEY_INFO
(
FILE
*fp
,
PKCS8_PRIV_KEY_INFO *x
);
EVP_PKEY *
PEM_read_bio_PUBKEY
(
BIO *bp
,
EVP_PKEY **x
,
pem_password_cb
*cb
,
void *u
);
EVP_PKEY *
PEM_read_PUBKEY
(
FILE *fp
,
EVP_PKEY **x
,
pem_password_cb
*cb
,
void *u
);
PEM_write_bio_PUBKEY
(
BIO *bp
,
EVP_PKEY *x
);
PEM_write_PUBKEY
(
FILE *fp
,
EVP_PKEY *x
);
RSA *
PEM_read_bio_RSAPrivateKey
(
BIO
*bp
,
RSA **x
,
pem_password_cb
*cb
,
void *u
);
RSA *
PEM_read_RSAPrivateKey
(
FILE *fp
,
RSA **x
,
pem_password_cb *cb
,
void *u
);
PEM_write_bio_RSAPrivateKey
(
BIO
*bp
,
RSA *x
,
const EVP_CIPHER
*enc
,
unsigned char *kstr
,
int
klen
,
pem_password_cb *cb
,
void
*u
);
PEM_write_RSAPrivateKey
(
FILE
*fp
,
RSA *x
,
const EVP_CIPHER
*enc
,
unsigned char *kstr
,
int
klen
,
pem_password_cb *cb
,
void
*u
);
RSA *
PEM_read_bio_RSAPublicKey
(
BIO
*bp
,
RSA **x
,
pem_password_cb
*cb
,
void *u
);
RSA *
PEM_read_RSAPublicKey
(
FILE *fp
,
RSA **x
,
pem_password_cb *cb
,
void *u
);
PEM_write_bio_RSAPublicKey
(
BIO
*bp
,
RSA *x
);
PEM_write_RSAPublicKey
(
FILE *fp
,
RSA *x
);
RSA *
PEM_read_bio_RSA_PUBKEY
(
BIO *bp
,
RSA **x
,
pem_password_cb *cb
,
void *u
);
RSA *
PEM_read_RSA_PUBKEY
(
FILE *fp
,
RSA **x
,
pem_password_cb *cb
,
void *u
);
PEM_write_bio_RSA_PUBKEY
(
BIO
*bp
,
RSA *x
);
PEM_write_RSA_PUBKEY
(
FILE *fp
,
RSA *x
);
DSA *
PEM_read_bio_DSAPrivateKey
(
BIO
*bp
,
DSA **x
,
pem_password_cb
*cb
,
void *u
);
DSA *
PEM_read_DSAPrivateKey
(
FILE *fp
,
DSA **x
,
pem_password_cb *cb
,
void *u
);
PEM_write_bio_DSAPrivateKey
(
BIO
*bp
,
DSA *x
,
const EVP_CIPHER
*enc
,
unsigned char *kstr
,
int
klen
,
pem_password_cb *cb
,
void
*u
);
PEM_write_DSAPrivateKey
(
FILE
*fp
,
DSA *x
,
const EVP_CIPHER
*enc
,
unsigned char *kstr
,
int
klen
,
pem_password_cb *cb
,
void
*u
);
DSA *
PEM_read_bio_DSA_PUBKEY
(
BIO *bp
,
DSA **x
,
pem_password_cb *cb
,
void *u
);
DSA *
PEM_read_DSA_PUBKEY
(
FILE *fp
,
DSA **x
,
pem_password_cb *cb
,
void *u
);
PEM_write_bio_DSA_PUBKEY
(
BIO
*bp
,
DSA *x
);
PEM_write_DSA_PUBKEY
(
FILE *fp
,
DSA *x
);
DSA *
PEM_read_bio_DSAparams
(
BIO *bp
,
DSA **x
,
pem_password_cb *cb
,
void *u
);
DSA *
PEM_read_DSAparams
(
FILE *fp
,
DSA **x
,
pem_password_cb *cb
,
void *u
);
PEM_write_bio_DSAparams
(
BIO *bp
,
DSA *x
);
PEM_write_DSAparams
(
FILE *fp
,
DSA *x
);
PEM_read_bio_DHparams
(
BIO *bp
,
DH **x
,
pem_password_cb *cb
,
void *u
);
PEM_read_DHparams
(
FILE *fp
,
DH **x
,
pem_password_cb *cb
,
void *u
);
PEM_write_bio_DHparams
(
BIO *bp
,
DH *x
);
PEM_write_DHparams
(
FILE *fp
,
DH *x
);
EC_GROUP *
PEM_read_bio_ECPKParameters
(
BIO
*bp
,
EC_GROUP **x
,
pem_password_cb *cb
,
void
*u
);
EC_GROUP *
PEM_read_ECPKParameters
(
FILE
*fp
,
EC_GROUP **x
,
pem_password_cb *cb
,
void
*u
);
PEM_write_bio_ECPKParameters
(
BIO
*bp
,
const EC_GROUP *x
);
PEM_write_ECPKParameters
(
FILE
*fp
,
const EC_GROUP *x
);
EC_KEY *
PEM_read_bio_ECPrivateKey
(
BIO
*bp
,
EC_KEY **key
,
pem_password_cb *cb
,
void
*u
);
EC_KEY *
PEM_read_ECPrivateKey
(
FILE *fp
,
EC_KEY **eckey
,
pem_password_cb
*cb
,
void *u
);
PEM_write_bio_ECPrivateKey
(
BIO
*bp
,
EC_KEY *x
,
const EVP_CIPHER
*enc
,
unsigned char *kstr
,
int
klen
,
pem_password_cb *cb
,
void
*u
);
PEM_write_ECPrivateKey
(
FILE *fp
,
EC_KEY *x
,
const EVP_CIPHER
*enc
,
unsigned char *kstr
,
int
klen
,
pem_password_cb *cb
,
void
*u
);
EC_KEY *
PEM_read_bio_EC_PUBKEY
(
BIO *bp
,
EC_KEY **x
,
pem_password_cb *cb
,
void *u
);
EC_KEY *
PEM_read_EC_PUBKEY
(
FILE *fp
,
EC_KEY **x
,
pem_password_cb *cb
,
void *u
);
PEM_write_bio_EC_PUBKEY
(
BIO *bp
,
EC_KEY *x
);
PEM_write_EC_PUBKEY
(
FILE *fp
,
EC_KEY *x
);
X509 *
PEM_read_bio_X509
(
BIO *bp
,
X509 **x
,
pem_password_cb *cb
,
void *u
);
X509 *
PEM_read_X509
(
FILE *fp
,
X509 **x
,
pem_password_cb *cb
,
void *u
);
PEM_write_bio_X509
(
BIO *bp
,
X509 *x
);
PEM_write_X509
(
FILE *fp
,
X509 *x
);
X509 *
PEM_read_bio_X509_AUX
(
BIO *bp
,
X509 **x
,
pem_password_cb *cb
,
void *u
);
X509 *
PEM_read_X509_AUX
(
FILE *fp
,
X509 **x
,
pem_password_cb *cb
,
void *u
);
PEM_write_bio_X509_AUX
(
BIO *bp
,
X509 *x
);
PEM_write_X509_AUX
(
FILE *fp
,
X509 *x
);
X509_REQ *
PEM_read_bio_X509_REQ
(
BIO *bp
,
X509_REQ **x
,
pem_password_cb
*cb
,
void *u
);
X509_REQ *
PEM_read_X509_REQ
(
FILE *fp
,
X509_REQ **x
,
pem_password_cb
*cb
,
void *u
);
PEM_write_bio_X509_REQ
(
BIO *bp
,
X509_REQ *x
);
PEM_write_X509_REQ
(
FILE *fp
,
X509_REQ *x
);
PEM_write_bio_X509_REQ_NEW
(
BIO
*bp
,
X509_REQ *x
);
PEM_write_X509_REQ_NEW
(
FILE *fp
,
X509_REQ *x
);
X509_CRL *
PEM_read_bio_X509_CRL
(
BIO *bp
,
X509_CRL **x
,
pem_password_cb
*cb
,
void *u
);
X509_CRL *
PEM_read_X509_CRL
(
FILE *fp
,
X509_CRL **x
,
pem_password_cb
*cb
,
void *u
);
PEM_write_bio_X509_CRL
(
BIO *bp
,
X509_CRL *x
);
PEM_write_X509_CRL
(
FILE *fp
,
X509_CRL *x
);
PKCS7 *
PEM_read_bio_PKCS7
(
BIO *bp
,
PKCS7 **x
,
pem_password_cb *cb
,
void *u
);
PKCS7 *
PEM_read_PKCS7
(
FILE *fp
,
PKCS7 **x
,
pem_password_cb *cb
,
void *u
);
PEM_write_bio_PKCS7
(
BIO *bp
,
PKCS7 *x
);
PEM_write_PKCS7
(
FILE *fp
,
PKCS7 *x
);
#include
<
openssl/cms.h
>
CMS_ContentInfo *
PEM_read_CMS
(
FILE *fp
,
CMS_ContentInfo **x
,
pem_password_cb
*cb
,
void *u
);
CMS_ContentInfo *
PEM_read_bio_CMS
(
BIO *bp
,
CMS_ContentInfo **x
,
pem_password_cb
*cb
,
void *u
);
PEM_write_CMS
(
FILE *fp
,
const CMS_ContentInfo *x
);
PEM_write_bio_CMS
(
BIO *bp
,
const CMS_ContentInfo *x
);
The PEM functions read or write structures in PEM format. In this
sense PEM format is simply base64-encoded data surrounded by header lines;
see
PEM_read(3)
for more details.
For more details about the meaning of arguments see the
PEM function arguments
section.
Each operation has four functions
associated with it. For brevity the term “
TYPE
functions
” will be used to collectively refer
to the
PEM_read_bio_TYPE
(),
PEM_read_TYPE
(),
PEM_write_bio_TYPE
(),
PEM_write_TYPE
()
functions. If no set of specific functions exists for a given type,
PEM_ASN1_read(3)
can be used instead.
The
PrivateKey
functions read or write a private
key in PEM format using an
EVP_PKEY
structure. The
write routines use "traditional" private key format and can handle
both RSA and DSA private keys. The read functions can additionally
transparently handle PKCS#8 format encrypted and unencrypted keys too.
PEM_write_bio_PKCS8PrivateKey
()
PEM_write_PKCS8PrivateKey
()
write a private key in an
EVP_PKEY
structure in PKCS#8
EncryptedPrivateKeyInfo
format using PKCS#5 v2.0
password based encryption algorithms. The
enc
argument
specifies the encryption algorithm to use: unlike all other PEM routines,
the encryption is applied at the PKCS#8 level and not in the PEM headers. If
enc
is
NULL
, then no
encryption is used and a PKCS#8
PrivateKeyInfo
structure is used instead.
PEM_write_bio_PKCS8PrivateKey_nid
()
PEM_write_PKCS8PrivateKey_nid
()
also write out a private key as a PKCS#8
EncryptedPrivateKeyInfo
. However they use PKCS#5 v1.5
or PKCS#12 encryption algorithms instead. The algorithm to use is specified
in the
nid
parameter and should be the NID of the
corresponding OBJECT IDENTIFIER.
PKCS8
functions
process an encrypted private key using an
X509_SIG
structure and the
d2i_X509_SIG(3)
function.
PKCS8_PRIV_KEY_INFO
functions process a private key using a
PKCS8_PRIV_KEY_INFO
structure.
PUBKEY
functions
process a public key using an
EVP_PKEY
structure. The
public key is encoded as an ASN.1
SubjectPublicKeyInfo
structure.
RSAPrivateKey
functions process an RSA private key using an
RSA
structure. They handle the same formats as the
PrivateKey
functions, but an error occurs if the private key is not RSA.
RSAPublicKey
functions process an RSA public key using an
RSA
structure. The public key is encoded using a PKCS#1
RSAPublicKey
structure.
RSA_PUBKEY
functions also process an RSA public key using an
RSA
structure. However the public key is encoded using an ASN.1
SubjectPublicKeyInfo
structure and an error occurs if
the public key is not RSA.
DSAPrivateKey
functions process a DSA private key using a
DSA
structure. They handle the same formats as the
PrivateKey
functions but an error occurs if the private key is not DSA.
DSA_PUBKEY
functions process a DSA public key using a
DSA
structure. The public key is encoded using an ASN.1
SubjectPublicKeyInfo
structure and an error occurs if
the public key is not DSA.
DSAparams
functions process DSA parameters using a
DSA
structure. The parameters are encoded using a Dss-Parms structure as defined
in RFC 2459.
DHparams
functions process DH parameters using a
DH
structure.
The parameters are encoded using a PKCS#3 DHparameter structure.
ECPKParameters
functions process EC parameters using an
EC_GROUP
structure and the
d2i_ECPKParameters(3)
function.
ECPrivateKey
functions process an EC private key using an
EC_KEY
structure.
EC_PUBKEY
functions process an EC public key using an
EC_KEY
structure.
X509
functions
process an X509 certificate using an
X509
structure.
They will also process a trusted X509 certificate but any trust settings are
discarded.
X509_AUX
functions process a trusted X509 certificate using an
X509
structure. The
X509_check_trust(3)
manual explains how the auxiliary trust
information is used.
The
X509_REQ
and
X509_REQ_NEW
functions process a PKCS#10 certificate request using an
X509_REQ
structure. The
X509_REQ
write functions use CERTIFICATE REQUEST in the header whereas the
X509_REQ_NEW
functions use NEW CERTIFICATE REQUEST (as
required by some CAs). The
X509_REQ
read functions will
handle either form so there are no
X509_REQ_NEW
read
functions.
X509_CRL
functions process an X509 CRL using an
X509_CRL
structure.
PKCS7
functions
process a PKCS#7
ContentInfo
using a
PKCS7
structure.
CMS
functions process
a
CMS_ContentInfo
structure.
The old
PrivateKey
write routines are retained for compatibility.
New applications should write private keys using the
PEM_write_bio_PKCS8PrivateKey
()
PEM_write_PKCS8PrivateKey
()
routines because they are more secure (they use an iteration count of 2048
whereas the traditional routines use a count of 1) unless compatibility with
older versions of OpenSSL is important.
The
PrivateKey
read routines can be used in all
applications because they handle all formats transparently.
function arguments
The PEM functions have many common arguments.
The
bp
parameter specifies the
BIO
to read from or write to.
The
fp
parameter specifies the
FILE
pointer to read from or write to.
The PEM read functions all take a pointer to pointer argument
x
and return a pointer of the same type. If
x
is
NULL
, then the parameter
is ignored. If
x
is not
NULL
but *
x
is
NULL
, then the
structure returned will be written to *
x
. If neither
x
nor *
x
are
NULL
, then an attempt is made to reuse the structure
at *
x
, but see the
BUGS
and
EXAMPLES
sections. Irrespective of
the value of
x
, a pointer to the structure is always
returned, or
NULL
if an error occurred.
The PEM functions which write private keys take an
enc
parameter, which specifies the encryption
algorithm to use. Encryption is done at the PEM level. If this parameter is
set to
NULL
, then the private key is written in
unencrypted form.
The optional arguments
u
and
cb
are a passphrase used for encrypting a PEM
structure or a callback to obtain the passphrase; see
pem_password_cb(3)
for details.
For the PEM write routines, if the
kstr
parameter is not
NULL
, then
klen
bytes at
kstr
are used as
the passphrase and
cb
is ignored.
encryption format
This old
PrivateKey
routines use a non-standard
technique for encryption.
The private key (or other data) takes the following form:
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,3F17F5316E2BAC89
...base64 encoded data...
-----END RSA PRIVATE KEY-----
The line beginning with “DEK-Info” contains two
comma separated pieces of information: the encryption algorithm name as used
EVP_get_cipherbyname(3)
and an 8-byte salt encoded as a set
of hexadecimal digits.
After this is the base64-encoded encrypted data.
The encryption key is determined using
EVP_BytesToKey(3)
, using the salt and an iteration count of 1. The IV
used is the value of the salt and *not* the IV returned by
EVP_BytesToKey(3)
.
The read routines return either a pointer to the structure read or
NULL
if an error occurred.
The write routines return 1 for success or 0 for failure.
Although the PEM routines take several arguments, in almost all
applications most of them are set to 0 or
NULL
.
Read a certificate in PEM format from a
BIO
:
X509 *x;
x = PEM_read_bio_X509(bp, NULL, 0, NULL);
if (x == NULL) {
/* Error */
Alternative method:
X509 *x = NULL;
if (!PEM_read_bio_X509(bp, &x, 0, NULL)) {
/* Error */
Write a certificate to a BIO:
if (!PEM_write_bio_X509(bp, x)) {
/* Error */
Write an unencrypted private key to a
FILE:
if (!PEM_write_PrivateKey(fp, key, NULL, NULL, 0, 0, NULL)) {
/* Error */
Write a private key (using traditional format) to a
BIO using triple DES encryption; the pass phrase is
prompted for:
if (!PEM_write_bio_PrivateKey(bp, key, EVP_des_ede3_cbc(),
NULL, 0, 0, NULL)) {
/* Error */
Write a private key (using PKCS#8 format) to a
BIO using triple DES encryption, using the pass phrase
"hello":
if (!PEM_write_bio_PKCS8PrivateKey(bp, key, EVP_des_ede3_cbc(),
NULL, 0, 0, "hello")) {
/* Error */
Read a private key from a BIO using the pass
phrase "hello":
key = PEM_read_bio_PrivateKey(bp, NULL, 0, "hello");
if (key == NULL) {
/* Error */
Read a private key from a BIO using a pass
phrase callback:
key = PEM_read_bio_PrivateKey(bp, NULL, pass_cb, "My Private Key");
if (key == NULL) {
/* Error */
Skeleton pass phrase callback:
pass_cb(char *buf, int size, int rwflag, void *u)
char *tmp;
size_t len;
/* We'd probably do something else if 'rwflag' is 1 */
printf("Enter pass phrase for \"%s\"\n", u);
* Instead of the following line, get the passphrase
* from the user in some way.
tmp = "hello";
if (tmp == NULL) /* An error occurred. */
return -1;
len = strlen(tmp);
if (len == 0) /* Treat an empty passphrase as an error, too. */
return -1;
/* if too long, truncate */
if (len > size)
len = size;
memcpy(buf, tmp, len);
return len;
BIO_new(3), DSA_new(3),
PEM_ASN1_read(3),
PEM_bytes_read_bio(3),
PEM_read(3),
PEM_read_SSL_SESSION(3),
PEM_write_bio_CMS_stream(3),
PEM_write_bio_PKCS7_stream(3),
PEM_X509_INFO_read(3),
RSA_new(3),
X509_CRL_new(3),
X509_REQ_new(3),
X509_SIG_new(3)
PEM_read_X509() and
PEM_write_X509() appeared in SSLeay 0.4 or earlier.
PEM_read_X509_REQ(),
PEM_write_X509_REQ(),
PEM_read_X509_CRL(), and
PEM_write_X509_CRL() first appeared in SSLeay 0.4.4.
PEM_read_RSAPrivateKey(),
PEM_write_RSAPrivateKey(),
PEM_read_DHparams(),
PEM_write_DHparams(),
PEM_read_PKCS7(), and
PEM_write_PKCS7() first appeared in SSLeay 0.5.1.
PEM_read_bio_PrivateKey(),
PEM_read_PrivateKey(),
PEM_read_bio_RSAPrivateKey(),
PEM_write_bio_RSAPrivateKey(),
PEM_read_bio_DSAPrivateKey(),
PEM_read_DSAPrivateKey(),
PEM_write_bio_DSAPrivateKey(),
PEM_write_DSAPrivateKey(),
PEM_read_bio_DHparams(),
PEM_write_bio_DHparams(),
PEM_read_bio_X509(),
PEM_write_bio_X509(),
PEM_read_bio_X509_REQ(),
PEM_write_bio_X509_REQ(),
PEM_read_bio_X509_CRL(),
PEM_write_bio_X509_CRL(),
PEM_read_bio_PKCS7(), and
PEM_write_bio_PKCS7() first appeared in SSLeay
0.6.0. PEM_write_bio_PrivateKey(),
PEM_write_PrivateKey(),
PEM_read_bio_DSAparams(),
PEM_read_DSAparams(),
PEM_write_bio_DSAparams(), and
PEM_write_DSAparams() first appeared in SSLeay
0.8.0. PEM_read_bio_RSAPublicKey(),
PEM_read_RSAPublicKey(),
PEM_write_bio_RSAPublicKey(), and
PEM_write_RSAPublicKey() first appeared in SSLeay
0.8.1. All these functions have been available since
OpenBSD 2.4.
PEM_write_bio_PKCS8PrivateKey(),
PEM_write_PKCS8PrivateKey(),
PEM_read_bio_PKCS8(),
PEM_read_PKCS8(),
PEM_write_bio_PKCS8(),
PEM_write_PKCS8(),
PEM_read_bio_PKCS8_PRIV_KEY_INFO(),
PEM_read_PKCS8_PRIV_KEY_INFO(),
PEM_write_bio_PKCS8_PRIV_KEY_INFO(),
PEM_write_PKCS8_PRIV_KEY_INFO(),
PEM_write_bio_PKCS8PrivateKey_nid(),
PEM_write_PKCS8PrivateKey_nid(),
PEM_read_bio_PUBKEY(),
PEM_read_PUBKEY(),
PEM_write_bio_PUBKEY(),
PEM_write_PUBKEY(),
PEM_read_bio_RSA_PUBKEY(),
PEM_read_RSA_PUBKEY(),
PEM_write_bio_RSA_PUBKEY(),
PEM_write_RSA_PUBKEY(),
PEM_read_bio_DSA_PUBKEY(),
PEM_read_DSA_PUBKEY(),
PEM_write_bio_DSA_PUBKEY(),
PEM_write_DSA_PUBKEY(),
PEM_write_bio_X509_REQ_NEW(),
PEM_write_X509_REQ_NEW(),
PEM_read_bio_X509_AUX(),
PEM_read_X509_AUX(),
PEM_write_bio_X509_AUX(), and
PEM_write_X509_AUX() first appeared in OpenSSL 0.9.5
and have been available since OpenBSD 2.7.
PEM_read_bio_ECPKParameters(),
PEM_read_ECPKParameters(),
PEM_write_bio_ECPKParameters(),
PEM_write_ECPKParameters(),
PEM_read_bio_ECPrivateKey(),
PEM_read_ECPrivateKey(),
PEM_write_bio_ECPrivateKey(),
PEM_write_ECPrivateKey(),
PEM_read_bio_EC_PUBKEY(),
PEM_read_EC_PUBKEY(),
PEM_write_bio_EC_PUBKEY(), and
PEM_write_EC_PUBKEY() first appeared in OpenSSL
0.9.8 and have been available since OpenBSD 4.5.
PEM_read_CMS(),
PEM_read_bio_CMS(),
PEM_write_CMS(), and
PEM_write_bio_CMS() first appeared in OpenSSL 0.9.8h
and have been available since OpenBSD 6.7.
A frequent cause of problems is attempting to use the PEM routines
like this:
X509 *x;
PEM_read_bio_X509(bp, &x, 0, NULL);
This is a bug because an attempt will be made to reuse the data at
x, which is an uninitialised pointer.
These functions make no assumption regarding the pass phrase
received from the password callback. It will simply be treated as a byte
sequence.
The PEM read routines in some versions of OpenSSL will not
correctly reuse an existing structure. Therefore
PEM_read_bio_X509(bp, &x, 0,
NULL);
where x already contains a valid certificate
may not work, whereas
X509_free(x);
x = PEM_read_bio_X509(bp, NULL, 0, NULL);
is guaranteed to work.