---
name: "gnutls_certificate_set_rawpk_key_mem"
section: "3"
platform: "linux"
package: "gnutls"
version: "3.8.13-3"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/gnutls_certificate_set_rawpk_key_mem"
---

# gnutls\_certificate\_set\_rawpk\_key\_mem(3)

API function

## NAME

gnutls\_certificate\_set\_rawpk\_key\_mem - API function

## SYNOPSIS

**#include \<gnutls/gnutls.h\>**

**int gnutls\_certificate\_set\_rawpk\_key\_mem(gnutls\_certificate\_credentials\_t** *cred***, const gnutls\_datum\_t \*** *spki***, const gnutls\_datum\_t \*** *pkey***, gnutls\_x509\_crt\_fmt\_t** *format***, const char \*** *pass***, unsigned int** *key\_usage***, const char \*\*** *names***, unsigned int** *names\_length***, unsigned int** *flags***);**

## ARGUMENTS

- gnutls\_certificate\_credentials\_t cred

  is a **gnutls\_certificate\_credentials\_t** type.

- const gnutls\_datum\_t \* spki

  contains a raw public key in PKIX.SubjectPublicKeyInfo format.

- const gnutls\_datum\_t \* pkey

  contains a raw private key.

- gnutls\_x509\_crt\_fmt\_t format

  encoding of the keys. DER or PEM.

- const char \* pass

  an optional password to unlock the private key pkey.

- unsigned int key\_usage

  An ORed sequence of **GNUTLS\_KEY\_**\* flags.

- const char \*\* names

  is an array of DNS names belonging to the public-key (NULL if none).

- unsigned int names\_length

  holds the length of the names list.

- unsigned int flags

  an ORed sequence of **gnutls\_pkcs\_encrypt\_flags\_t**. These apply to the private key pkey.

## DESCRIPTION

This function sets a public/private keypair in the **gnutls\_certificate\_credentials\_t** type to be used for authentication and/or encryption.  *spki* and  *privkey* should match otherwise set signatures cannot be validated. In case of no match this function returns **GNUTLS\_E\_CERTIFICATE\_KEY\_MISMATCH**. This function should be called once for the client because there is currently no mechanism to determine which raw public-key to select for the peer when there are multiple present. Multiple raw public keys for the server can be distinghuished by setting the  *names* .

Note here that  *spki* is a raw public-key as defined in RFC7250. It means that there is no surrounding certificate that holds the public key and that there is therefore no direct mechanism to prove the authenticity of this key. The keypair can be used during a TLS handshake but its authenticity should be established via a different mechanism (e.g. TOFU or known fingerprint).

The supported formats are basic unencrypted key, PKCS8, PKCS12, and the openssl format and will be autodetected.

If the raw public-key and the private key are given in PEM encoding then the strings that hold their values must be null terminated.

Key usage (as defined by X.509 extension (2.5.29.15)) can be explicitly set because there is no certificate structure around the key to define this value. See for more info **gnutls\_x509\_crt\_get\_key\_usage()**.

Note that, this function by default returns zero on success and a negative value on error. Since 3.5.6, when the flag **GNUTLS\_CERTIFICATE\_API\_V2** is set using **gnutls\_certificate\_set\_flags()** it returns an index (greater or equal to zero). That index can be used in other functions to refer to the added key-pair.

## RETURNS

On success, **GNUTLS\_E\_SUCCESS** (0) is returned, in case the key pair does not match **GNUTLS\_E\_CERTIFICATE\_KEY\_MISMATCH** is returned, in other erroneous cases a different negative error code is returned.

## SINCE

3\.6.6

## REPORTING BUGS

Report bugs to \<bugs@gnutls.org\>.\
 Home page: https://www.gnutls.org

## COPYRIGHT

Copyright © 2001-2023 Free Software Foundation, Inc., and others.\
 Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

## SEE ALSO

The full documentation for **gnutls** is maintained as a Texinfo manual. If the /usr/share/doc/gnutls/ directory does not contain the HTML form visit

- https://www.gnutls.org/manual/