1*4724848cSchristos=pod 2*4724848cSchristos 3*4724848cSchristos=head1 NAME 4*4724848cSchristos 5*4724848cSchristosPKCS12_create - create a PKCS#12 structure 6*4724848cSchristos 7*4724848cSchristos=head1 SYNOPSIS 8*4724848cSchristos 9*4724848cSchristos #include <openssl/pkcs12.h> 10*4724848cSchristos 11*4724848cSchristos PKCS12 *PKCS12_create(const char *pass, const char *name, EVP_PKEY *pkey, 12*4724848cSchristos X509 *cert, STACK_OF(X509) *ca, 13*4724848cSchristos int nid_key, int nid_cert, int iter, int mac_iter, int keytype); 14*4724848cSchristos 15*4724848cSchristos=head1 DESCRIPTION 16*4724848cSchristos 17*4724848cSchristosPKCS12_create() creates a PKCS#12 structure. 18*4724848cSchristos 19*4724848cSchristosB<pass> is the passphrase to use. B<name> is the B<friendlyName> to use for 20*4724848cSchristosthe supplied certificate and key. B<pkey> is the private key to include in 21*4724848cSchristosthe structure and B<cert> its corresponding certificates. B<ca>, if not B<NULL> 22*4724848cSchristosis an optional set of certificates to also include in the structure. 23*4724848cSchristos 24*4724848cSchristosB<nid_key> and B<nid_cert> are the encryption algorithms that should be used 25*4724848cSchristosfor the key and certificate respectively. The modes 26*4724848cSchristosGCM, CCM, XTS, and OCB are unsupported. B<iter> is the encryption algorithm 27*4724848cSchristositeration count to use and B<mac_iter> is the MAC iteration count to use. 28*4724848cSchristosB<keytype> is the type of key. 29*4724848cSchristos 30*4724848cSchristos=head1 NOTES 31*4724848cSchristos 32*4724848cSchristosThe parameters B<nid_key>, B<nid_cert>, B<iter>, B<mac_iter> and B<keytype> 33*4724848cSchristoscan all be set to zero and sensible defaults will be used. 34*4724848cSchristos 35*4724848cSchristosThese defaults are: 40 bit RC2 encryption for certificates, triple DES 36*4724848cSchristosencryption for private keys, a key iteration count of PKCS12_DEFAULT_ITER 37*4724848cSchristos(currently 2048) and a MAC iteration count of 1. 38*4724848cSchristos 39*4724848cSchristosThe default MAC iteration count is 1 in order to retain compatibility with 40*4724848cSchristosold software which did not interpret MAC iteration counts. If such compatibility 41*4724848cSchristosis not required then B<mac_iter> should be set to PKCS12_DEFAULT_ITER. 42*4724848cSchristos 43*4724848cSchristosB<keytype> adds a flag to the store private key. This is a non standard extension 44*4724848cSchristosthat is only currently interpreted by MSIE. If set to zero the flag is omitted, 45*4724848cSchristosif set to B<KEY_SIG> the key can be used for signing only, if set to B<KEY_EX> 46*4724848cSchristosit can be used for signing and encryption. This option was useful for old 47*4724848cSchristosexport grade software which could use signing only keys of arbitrary size but 48*4724848cSchristoshad restrictions on the permissible sizes of keys which could be used for 49*4724848cSchristosencryption. 50*4724848cSchristos 51*4724848cSchristosIf a certificate contains an B<alias> or B<keyid> then this will be 52*4724848cSchristosused for the corresponding B<friendlyName> or B<localKeyID> in the 53*4724848cSchristosPKCS12 structure. 54*4724848cSchristos 55*4724848cSchristosEither B<pkey>, B<cert> or both can be B<NULL> to indicate that no key or 56*4724848cSchristoscertificate is required. In previous versions both had to be present or 57*4724848cSchristosa fatal error is returned. 58*4724848cSchristos 59*4724848cSchristosB<nid_key> or B<nid_cert> can be set to -1 indicating that no encryption 60*4724848cSchristosshould be used. 61*4724848cSchristos 62*4724848cSchristosB<mac_iter> can be set to -1 and the MAC will then be omitted entirely. 63*4724848cSchristos 64*4724848cSchristosPKCS12_create() makes assumptions regarding the encoding of the given pass 65*4724848cSchristosphrase. 66*4724848cSchristosSee L<passphrase-encoding(7)> for more information. 67*4724848cSchristos 68*4724848cSchristos=head1 RETURN VALUES 69*4724848cSchristos 70*4724848cSchristosPKCS12_create() returns a valid B<PKCS12> structure or NULL if an error occurred. 71*4724848cSchristos 72*4724848cSchristos=head1 SEE ALSO 73*4724848cSchristos 74*4724848cSchristosL<d2i_PKCS12(3)>, 75*4724848cSchristosL<passphrase-encoding(7)> 76*4724848cSchristos 77*4724848cSchristos=head1 COPYRIGHT 78*4724848cSchristos 79*4724848cSchristosCopyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved. 80*4724848cSchristos 81*4724848cSchristosLicensed under the OpenSSL license (the "License"). You may not use 82*4724848cSchristosthis file except in compliance with the License. You can obtain a copy 83*4724848cSchristosin the file LICENSE in the source distribution or at 84*4724848cSchristosL<https://www.openssl.org/source/license.html>. 85*4724848cSchristos 86*4724848cSchristos=cut 87