---
name: "libressl-CMS_add1_recipient_cert"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-CMS_add1_recipient_cert"
---

# libressl-CMS\_add1\_recipient\_cert(3)

add recipients to a CMS EnvelopedData structure

## NAME

**CMS\_add1\_recipient\_cert**, **CMS\_add0\_recipient\_key** – add recipients to a CMS EnvelopedData structure

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/cms.h\>**

*CMS\_RecipientInfo* *\**\

**CMS\_add1\_recipient\_cert**(*CMS\_ContentInfo \*cms*, *X509 \*certificate*, *unsigned int flags*);

*CMS\_RecipientInfo* *\**\

**CMS\_add0\_recipient\_key**(*CMS\_ContentInfo \*cms*, *int nid*, *unsigned char \*key*, *size\_t keylen*, *unsigned char \*id*, *size\_t idlen*, *ASN1\_GENERALIZEDTIME \*date*, *ASN1\_OBJECT \*otherTypeId*, *ASN1\_TYPE \*otherType*);

## DESCRIPTION

These functions add a new *RecipientInfo* structure to the *recipientInfos* field of the *EnvelopedData* structure *cms*, which should have been obtained from an initial call to CMS\_encrypt(3) with the flag CMS\_PARTIAL set.

**CMS\_add1\_recipient\_cert**() adds the recipient *certificate* as a *KeyTransRecipientInfo* structure.

**CMS\_add0\_recipient\_key**() adds the symmetric *key* of length *keylen* using the wrapping algorithm *nid*, the identifier *id* of length *idlen*, and the optional values *date*, *otherTypeId* and *otherType* as a *KEKRecipientInfo* structure.

The main purpose of these functions is to provide finer control over a CMS *EnvelopedData* structure where the simpler CMS\_encrypt(3) function defaults are not appropriate, for example if one or more *KEKRecipientInfo* structures need to be added. New attributes can also be added using the returned *CMS\_RecipientInfo* structure and the CMS attribute utility functions.

By default, recipient certificates are identified using issuer name and serial number. If the flag CMS\_USE\_KEYID is set, the subject key identifier value is used instead. An error occurs if all recipient certificates do not have a subject key identifier extension.

Currently only AES based key wrapping algorithms are supported for *nid*, specifically NID\_id\_aes128\_wrap, NID\_id\_aes192\_wrap, and NID\_id\_aes256\_wrap. If *nid* is set to NID\_undef, then an AES wrap algorithm will be used consistent with *keylen*.

## RETURN VALUES

**CMS\_add1\_recipient\_cert**() and **CMS\_add0\_recipient\_key**() return an internal pointer to the *CMS\_RecipientInfo* structure just added or NULL if an error occurs.

## SEE ALSO

CMS\_ContentInfo\_new(3), CMS\_encrypt(3), CMS\_final(3), ERR\_get\_error(3)

## STANDARDS

RFC 5652: Cryptographic Message Syntax

- section 6.1: EnvelopedData Type

- section 6.2.1: KeyTransRecipientInfo Type

- section 6.2.3: KEKRecipientInfo Type

## HISTORY

**CMS\_add1\_recipient\_cert**() and **CMS\_add0\_recipient\_key**() first appeared in OpenSSL 0.9.8h and have been available since OpenBSD 6.7.