1*4724848cSchristos=pod 2*4724848cSchristos 3*4724848cSchristos=head1 NAME 4*4724848cSchristos 5*4724848cSchristosPKCS12_newpass - change the password of a PKCS12 structure 6*4724848cSchristos 7*4724848cSchristos=head1 SYNOPSIS 8*4724848cSchristos 9*4724848cSchristos #include <openssl/pkcs12.h> 10*4724848cSchristos 11*4724848cSchristos int PKCS12_newpass(PKCS12 *p12, const char *oldpass, const char *newpass); 12*4724848cSchristos 13*4724848cSchristos=head1 DESCRIPTION 14*4724848cSchristos 15*4724848cSchristosPKCS12_newpass() changes the password of a PKCS12 structure. 16*4724848cSchristos 17*4724848cSchristosB<p12> is a pointer to a PKCS12 structure. B<oldpass> is the existing password 18*4724848cSchristosand B<newpass> is the new password. 19*4724848cSchristos 20*4724848cSchristos=head1 NOTES 21*4724848cSchristos 22*4724848cSchristosEach of B<oldpass> and B<newpass> is independently interpreted as a string in 23*4724848cSchristosthe UTF-8 encoding. If it is not valid UTF-8, it is assumed to be ISO8859-1 24*4724848cSchristosinstead. 25*4724848cSchristos 26*4724848cSchristosIn particular, this means that passwords in the locale character set 27*4724848cSchristos(or code page on Windows) must potentially be converted to UTF-8 before 28*4724848cSchristosuse. This may include passwords from local text files, or input from 29*4724848cSchristosthe terminal or command line. Refer to the documentation of 30*4724848cSchristosL<UI_OpenSSL(3)>, for example. 31*4724848cSchristos 32*4724848cSchristos=head1 RETURN VALUES 33*4724848cSchristos 34*4724848cSchristosPKCS12_newpass() returns 1 on success or 0 on failure. Applications can 35*4724848cSchristosretrieve the most recent error from PKCS12_newpass() with ERR_get_error(). 36*4724848cSchristos 37*4724848cSchristos=head1 EXAMPLES 38*4724848cSchristos 39*4724848cSchristosThis example loads a PKCS#12 file, changes its password and writes out 40*4724848cSchristosthe result to a new file. 41*4724848cSchristos 42*4724848cSchristos #include <stdio.h> 43*4724848cSchristos #include <stdlib.h> 44*4724848cSchristos #include <openssl/pem.h> 45*4724848cSchristos #include <openssl/err.h> 46*4724848cSchristos #include <openssl/pkcs12.h> 47*4724848cSchristos 48*4724848cSchristos int main(int argc, char **argv) 49*4724848cSchristos { 50*4724848cSchristos FILE *fp; 51*4724848cSchristos PKCS12 *p12; 52*4724848cSchristos 53*4724848cSchristos if (argc != 5) { 54*4724848cSchristos fprintf(stderr, "Usage: pkread p12file password newpass opfile\n"); 55*4724848cSchristos return 1; 56*4724848cSchristos } 57*4724848cSchristos if ((fp = fopen(argv[1], "rb")) == NULL) { 58*4724848cSchristos fprintf(stderr, "Error opening file %s\n", argv[1]); 59*4724848cSchristos return 1; 60*4724848cSchristos } 61*4724848cSchristos p12 = d2i_PKCS12_fp(fp, NULL); 62*4724848cSchristos fclose(fp); 63*4724848cSchristos if (p12 == NULL) { 64*4724848cSchristos fprintf(stderr, "Error reading PKCS#12 file\n"); 65*4724848cSchristos ERR_print_errors_fp(stderr); 66*4724848cSchristos return 1; 67*4724848cSchristos } 68*4724848cSchristos if (PKCS12_newpass(p12, argv[2], argv[3]) == 0) { 69*4724848cSchristos fprintf(stderr, "Error changing password\n"); 70*4724848cSchristos ERR_print_errors_fp(stderr); 71*4724848cSchristos PKCS12_free(p12); 72*4724848cSchristos return 1; 73*4724848cSchristos } 74*4724848cSchristos if ((fp = fopen(argv[4], "wb")) == NULL) { 75*4724848cSchristos fprintf(stderr, "Error opening file %s\n", argv[4]); 76*4724848cSchristos PKCS12_free(p12); 77*4724848cSchristos return 1; 78*4724848cSchristos } 79*4724848cSchristos i2d_PKCS12_fp(fp, p12); 80*4724848cSchristos PKCS12_free(p12); 81*4724848cSchristos fclose(fp); 82*4724848cSchristos return 0; 83*4724848cSchristos } 84*4724848cSchristos 85*4724848cSchristos 86*4724848cSchristos=head1 NOTES 87*4724848cSchristos 88*4724848cSchristosIf the PKCS#12 structure does not have a password, then you must use the empty 89*4724848cSchristosstring "" for B<oldpass>. Using NULL for B<oldpass> will result in a 90*4724848cSchristosPKCS12_newpass() failure. 91*4724848cSchristos 92*4724848cSchristosIf the wrong password is used for B<oldpass> then the function will fail, 93*4724848cSchristoswith a MAC verification error. In rare cases the PKCS12 structure does not 94*4724848cSchristoscontain a MAC: in this case it will usually fail with a decryption padding 95*4724848cSchristoserror. 96*4724848cSchristos 97*4724848cSchristos=head1 BUGS 98*4724848cSchristos 99*4724848cSchristosThe password format is a NULL terminated ASCII string which is converted to 100*4724848cSchristosUnicode form internally. As a result some passwords cannot be supplied to 101*4724848cSchristosthis function. 102*4724848cSchristos 103*4724848cSchristos=head1 SEE ALSO 104*4724848cSchristos 105*4724848cSchristosL<PKCS12_create(3)>, L<ERR_get_error(3)>, 106*4724848cSchristosL<passphrase-encoding(7)> 107*4724848cSchristos 108*4724848cSchristos=head1 COPYRIGHT 109*4724848cSchristos 110*4724848cSchristosCopyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved. 111*4724848cSchristos 112*4724848cSchristosLicensed under the OpenSSL license (the "License"). You may not use 113*4724848cSchristosthis file except in compliance with the License. You can obtain a copy 114*4724848cSchristosin the file LICENSE in the source distribution or at 115*4724848cSchristosL<https://www.openssl.org/source/license.html>. 116*4724848cSchristos 117*4724848cSchristos=cut 118