---
name: "libressl-ASN1_item_sign"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-ASN1_item_sign"
---

# libressl-ASN1\_item\_sign(3)

DER-encode and sign an ASN.1 value

## NAME

**ASN1\_item\_sign**, **ASN1\_item\_sign\_ctx** – DER-encode and sign an ASN.1 value

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509.h\>**

*int*\

**ASN1\_item\_sign**(*const ASN1\_ITEM \*it*, *X509\_ALGOR \*algor1*, *X509\_ALGOR \*algor2*, *ASN1\_BIT\_STRING \*sig\_out*, *void \*val\_in*, *EVP\_PKEY \*pkey*, *const EVP\_MD \*type*);

*int*\

**ASN1\_item\_sign\_ctx**(*const ASN1\_ITEM \*it*, *X509\_ALGOR \*algor1*, *X509\_ALGOR \*algor2*, *ASN1\_BIT\_STRING \*sig\_out*, *void \*val\_in*, *EVP\_MD\_CTX \*ctx*);

## DESCRIPTION

**ASN1\_item\_sign**() assumes that *val\_in* is an *ASN1\_VALUE* of the type specified by *it*, encodes it into DER format by calling ASN1\_item\_i2d(3), and signs the resulting byte array in a way similar to EVP\_DigestSign(3), using a signing context created with EVP\_DigestSignInit(3) for the given digest *type* and private key *pkey*. The created signature is placed into the *sig\_out* object provided by the caller, freeing and replacing any data already contained in that object.

**ASN1\_item\_sign\_ctx**() is similar except that the provided *ctx* is used rather than creating a new one. No matter whether **ASN1\_item\_sign\_ctx**() succeeds or fails, EVP\_MD\_CTX\_cleanup(3) is called on *ctx* before returning.

For both functions, unless *algor1* is NULL, its algorithm OID and parameter type are set according to the digest *type* used, and its parameter value is cleared. In RSA-PSS mode, the parameter value is also copied into *algor1*. Unless *algor2* is NULL, the same data is copied into it.

## RETURN VALUES

These functions return the length of the signature in bytes or 0 if memory allocation, encoding, or signing fails.

**ASN1\_item\_sign\_ctx**() also fails and returns 0 if *ctx* is not fully initialized.

## SEE ALSO

ASN1\_BIT\_STRING\_new(3), ASN1\_item\_digest(3), ASN1\_item\_i2d(3), ASN1\_item\_verify(3), EVP\_Digest(3), EVP\_DigestSign(3), EVP\_MD\_CTX\_new(3), EVP\_PKEY\_new(3), OBJ\_find\_sigid\_by\_algs(3), X509\_ALGOR\_new(3)

## HISTORY

**ASN1\_item\_sign**() first appeared in OpenSSL 0.9.7 and has been available since OpenBSD 3.1.

**ASN1\_item\_sign\_ctx**() first appeared in OpenSSL 1.0.1 and has been available since OpenBSD 5.3.