---
name: "libressl-CMS_add1_signer"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-CMS_add1_signer"
---

# libressl-CMS\_add1\_signer(3)

add a signer to a CMS SignedData structure

## NAME

**CMS\_add1\_signer**, **CMS\_SignerInfo\_sign** – add a signer to a CMS SignedData structure

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/cms.h\>**

*CMS\_SignerInfo* *\**\

**CMS\_add1\_signer**(*CMS\_ContentInfo \*cms*, *X509 \*signcert*, *EVP\_PKEY \*pkey*, *const EVP\_MD \*md*, *unsigned int flags*);

*int*\

**CMS\_SignerInfo\_sign**(*CMS\_SignerInfo \*si*);

## DESCRIPTION

**CMS\_add1\_signer**() adds a signer with certificate *signcert* and private key *pkey* using message digest *md* to the *signerInfos* field of the *SignedData* structure *cms*, which should have been obtained from an initial call to CMS\_sign(3) with the flag CMS\_PARTIAL set, or which can be a valid *SignedData* structure in the case of re-signing.

If *md* is NULL, the default digest for the public key algorithm of *pkey* is used.

Unless the CMS\_REUSE\_DIGEST flag is set, the *cms* structure remains incomplete and must be finalized either by streaming (if applicable) or by a call to CMS\_final(3).

The main purpose of **CMS\_add1\_signer**() is to provide finer control over a CMS *SignedData* structure where the simpler CMS\_sign(3) function defaults are not appropriate, for example if multiple signers or non default digest algorithms are needed. New attributes can also be added using the returned *CMS\_SignerInfo* structure and the CMS attribute utility functions or the CMS signed receipt request functions.

Any of the following flags (OR'ed together) can be passed in the *flags* parameter:

- CMS\_REUSE\_DIGEST

  Attempt to copy the content digest value from one of the existing *CMS\_SignerInfo* structures in *cms* while adding another signer. An error occurs if a matching digest value cannot be found to copy. The *cms* structure will be valid and finalized when this flag is set.

- CMS\_PARTIAL

  If this flag is set in addition to CMS\_REUSE\_DIGEST, the returned *CMS\_SignerInfo* structure will not be finalized so additional attributes can be added. In this case an explicit call to **CMS\_SignerInfo\_sign**() is needed to finalize it.

- CMS\_NOCERTS

  Do not add the signer's certificate to the *certificates* field of *cms*. The signer's certificate must still be supplied in the *signcert* parameter though. This flag can reduce the size of the signature if the signer's certificate can be obtained by other means, for example from a previously signed message.

- CMS\_NOATTR

  Leave the *signedAttrs* field of the returned *CMS\_SignedData* structure empty. By default, several CMS *SignedAttributes* are added, including the signing time, the CMS content type, and the supported list of ciphers in an *SMIMECapabilities* attribute.

- CMS\_NOSMIMECAP

  Omit just the *SMIMECapabilities* attribute.

- CMS\_USE\_KEYID

  Use the subject key identifier value to identify signing certificates. An error occurs if the signing certificate does not have a subject key identifier extension. By default, issuer name and serial number are used instead.

If present, the *SMIMECapabilities* attribute indicates support for the following algorithms in preference order: 256-bit AES, 192-bit AES, 128-bit AES, triple DES, 128-bit RC2, 64-bit RC2, DES and 40-bit RC2. If any of these algorithms is not available then it will not be included.

The **CMS\_SignerInfo\_sign**() function explicitly signs *si*. Its main use is when the CMS\_REUSE\_DIGEST and CMS\_PARTIAL flags were both set in the call to **CMS\_add1\_signer**() that created *si*.

## RETURN VALUES

**CMS\_add1\_signer**() returns an internal pointer to the new *CMS\_SignerInfo* structure just added or NULL if an error occurs.

## SEE ALSO

CMS\_ContentInfo\_new(3), CMS\_final(3), CMS\_sign(3), ERR\_get\_error(3)

## STANDARDS

RFC 5652: Cryptographic Message Syntax, section 5.1: SignedData Type

RFC 8419: Use of Edwards-Curve Digital Signature Algorithm (EdDSA) Signatures in the Cryptographic Message Syntax (CMS)

RFC 8551: Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 4.0 Message Specification

- section 2.5: Attributes and the SignerInfo Type

- section 2.5.2: SMIMECapabilities Attribute

## HISTORY

**CMS\_add1\_signer**() and **CMS\_SignerInfo\_sign**() first appeared in OpenSSL 0.9.8h and have been available since OpenBSD 6.7.