xref: /freebsd-src/crypto/openssl/doc/man3/PKCS12_newpass.pod (revision da327cd22e88f26f6cab9d4c45805b512139aa11)

=pod

=head1 NAME

PKCS12_newpass - change the password of a PKCS12 structure

=head1 SYNOPSIS

 #include <openssl/pkcs12.h>

 int PKCS12_newpass(PKCS12 *p12, const char *oldpass, const char *newpass);

=head1 DESCRIPTION

PKCS12_newpass() changes the password of a PKCS12 structure.

B<p12> is a pointer to a PKCS12 structure. B<oldpass> is the existing password
and B<newpass> is the new password.

=head1 NOTES

Each of B<oldpass> and B<newpass> is independently interpreted as a string in
the UTF-8 encoding. If it is not valid UTF-8, it is assumed to be ISO8859-1
instead.

In particular, this means that passwords in the locale character set
(or code page on Windows) must potentially be converted to UTF-8 before
use. This may include passwords from local text files, or input from
the terminal or command line. Refer to the documentation of
L<UI_OpenSSL(3)>, for example.

=head1 RETURN VALUES

PKCS12_newpass() returns 1 on success or 0 on failure. Applications can
retrieve the most recent error from PKCS12_newpass() with ERR_get_error().

=head1 EXAMPLES

This example loads a PKCS#12 file, changes its password and writes out
the result to a new file.

 #include <stdio.h>
 #include <stdlib.h>
 #include <openssl/pem.h>
 #include <openssl/err.h>
 #include <openssl/pkcs12.h>

 int main(int argc, char **argv)
 {
     FILE *fp;
     PKCS12 *p12;

     if (argc != 5) {
         fprintf(stderr, "Usage: pkread p12file password newpass opfile\n");
         return 1;
     }
     if ((fp = fopen(argv[1], "rb")) == NULL) {
         fprintf(stderr, "Error opening file %s\n", argv[1]);
         return 1;
     }
     p12 = d2i_PKCS12_fp(fp, NULL);
     fclose(fp);
     if (p12 == NULL) {
         fprintf(stderr, "Error reading PKCS#12 file\n");
         ERR_print_errors_fp(stderr);
         return 1;
     }
     if (PKCS12_newpass(p12, argv[2], argv[3]) == 0) {
         fprintf(stderr, "Error changing password\n");
         ERR_print_errors_fp(stderr);
         PKCS12_free(p12);
         return 1;
     }
     if ((fp = fopen(argv[4], "wb")) == NULL) {
         fprintf(stderr, "Error opening file %s\n", argv[4]);
         PKCS12_free(p12);
         return 1;
     }
     i2d_PKCS12_fp(fp, p12);
     PKCS12_free(p12);
     fclose(fp);
     return 0;
 }


=head1 NOTES

If the PKCS#12 structure does not have a password, then you must use the empty
string "" for B<oldpass>. Using NULL for B<oldpass> will result in a
PKCS12_newpass() failure.

If the wrong password is used for B<oldpass> then the function will fail,
with a MAC verification error. In rare cases the PKCS12 structure does not
contain a MAC: in this case it will usually fail with a decryption padding
error.

=head1 BUGS

The password format is a NULL terminated ASCII string which is converted to
Unicode form internally. As a result some passwords cannot be supplied to
this function.

=head1 SEE ALSO

L<PKCS12_create(3)>, L<ERR_get_error(3)>,
L<passphrase-encoding(7)>

=head1 COPYRIGHT

Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the OpenSSL license (the "License").  You may not use
this file except in compliance with the License.  You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.

=cut