PKCS7_sign(3) OpenSSL PKCS7_sign(3) NNAAMMEE PKCS7_sign - create a PKCS#7 signedData structure SSYYNNOOPPSSIISS #include PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs, BIO *data, int flags); DDEESSCCRRIIPPTTIIOONN _P_K_C_S_7___s_i_g_n_(_) creates and returns a PKCS#7 signedData structure. ssiiggnncceerrtt is the certificate to sign with, ppkkeeyy is the corresponsding private key. cceerrttss is an optional additional set of certificates to include in the PKCS#7 structure (for example any intermediate CAs in the chain). The data to be signed is read from BIO ddaattaa. ffllaaggss is an optional set of flags. NNOOTTEESS Any of the following flags (ored together) can be passed in the ffllaaggss parameter. Many S/MIME clients expect the signed content to include valid MIME headers. If the PPKKCCSS77__TTEEXXTT flag is set MIME headers for type tteexxtt//ppllaaiinn are prepended to the data. If PPKKCCSS77__NNOOCCEERRTTSS is set the signer's certificate will not be included in the PKCS7 structure, the signer's certificate must still be supplied in the ssiiggnncceerrtt parameter though. This can reduce the size of the sig- nature if the signers certificate can be obtained by other means: for example a previously signed message. The data being signed is included in the PKCS7 structure, unless PPKKCCSS77__DDEETTAACCHHEEDD is set in which case it is omitted. This is used for PKCS7 detached signatures which are used in S/MIME plaintext signed messages for example. Normally the supplied content is translated into MIME canonical format (as required by the S/MIME specifications) if PPKKCCSS77__BBIINNAARRYY is set no translation occurs. This option should be used if the supplied data is in binary format otherwise the translation will corrupt it. The signedData structure includes several PKCS#7 autenticatedAttributes including the signing time, the PKCS#7 content type and the supported list of ciphers in an SMIMECapabilities attribute. If PPKKCCSS77__NNOOAATTTTRR is set then no authenticatedAttributes will be used. If PPKKCCSS77__NNOOSSMMIIMMEECCAAPP is set then just the SMIMECapabilities are omitted. If present the SMIMECapabilities attribute indicates support for the following algorithms: triple DES, 128 bit RC2, 64 bit RC2, DES and 40 bit RC2. If any of these algorithms is disabled then it will not be included. If the flags PPKKCCSS77__SSTTRREEAAMM is set then the returned PPKKCCSS77 structure is just initialized ready to perform the signing operation. The signing is however nnoott performed and the data to be signed is not read from the ddaattaa parameter. Signing is deferred until after the data has been writ- ten. In this way data can be signed in a single pass. If the PPKKCCSS77__PPAARRTTIIAALL flag is set a partial PPKKCCSS77 structure is output to which additional signers and capabilities can be added before finaliza- tion. NNOOTTEESS If the flag PPKKCCSS77__SSTTRREEAAMM is set the returned PPKKCCSS77 structure is nnoott complete and outputting its contents via a function that does not prop- erly finalize the PPKKCCSS77 structure will give unpredictable results. Several functions including _S_M_I_M_E___w_r_i_t_e___P_K_C_S_7_(_), _i_2_d___P_K_C_S_7___b_i_o___s_t_r_e_a_m_(_), _P_E_M___w_r_i_t_e___b_i_o___P_K_C_S_7___s_t_r_e_a_m_(_) finalize the structure. Alternatively finalization can be performed by obtaining the streaming ASN1 BBIIOO directly using _B_I_O___n_e_w___P_K_C_S_7_(_). If a signer is specified it will use the default digest for the signing algorithm. This is SSHHAA11 for both RSA and DSA keys. In OpenSSL 1.0.0 the cceerrttss, ssiiggnncceerrtt and ppkkeeyy parameters can all be NNUULLLL if the PPKKCCSS77__PPAARRTTIIAALL flag is set. One or more signers can be added using the function _PP_KK_CC_SS_77____ss_ii_gg_nn____aa_dd_dd____ss_ii_gg_nn_ee_rr_((_)). _PP_KK_CC_SS_77____ff_ii_nn_aa_ll_((_)) must also be called to finalize the structure if streaming is not enabled. Alterna- tive signing digests can also be specified using this method. In OpenSSL 1.0.0 if ssiiggnncceerrtt and ppkkeeyy are NULL then a certificates only PKCS#7 structure is output. In versions of OpenSSL before 1.0.0 the ssiiggnncceerrtt and ppkkeeyy parameters must NNOOTT be NULL. BBUUGGSS Some advanced attributes such as counter signatures are not supported. RREETTUURRNN VVAALLUUEESS _P_K_C_S_7___s_i_g_n_(_) returns either a valid PKCS7 structure or NULL if an error occurred. The error can be obtained from _E_R_R___g_e_t___e_r_r_o_r(3). SSEEEE AALLSSOO _E_R_R___g_e_t___e_r_r_o_r(3), _P_K_C_S_7___v_e_r_i_f_y(3) HHIISSTTOORRYY _P_K_C_S_7___s_i_g_n_(_) was added to OpenSSL 0.9.5 The PPKKCCSS77__PPAARRTTIIAALL flag was added in OpenSSL 1.0.0 The PPKKCCSS77__SSTTRREEAAMM flag was added in OpenSSL 1.0.0 1.0.2u 2019-12-20 PKCS7_sign(3)