---
name: "libressl-CMS_encrypt"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-CMS_encrypt"
---

# libressl-CMS\_encrypt(3)

create a CMS EnvelopedData structure

## NAME

**CMS\_encrypt** – create a CMS EnvelopedData structure

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/cms.h\>**

*CMS\_ContentInfo* *\**\

**CMS\_encrypt**(*STACK\_OF(X509) \*certificates*, *BIO \*in*, *const EVP\_CIPHER \*cipher*, *unsigned int flags*);

## DESCRIPTION

**CMS\_encrypt**() creates a CMS *EnvelopedData* structure, encrypting the content provided by *in*.

The recipient *certificates* are added as *KeyTransRecipientInfo* structures by calling the function CMS\_add1\_recipient\_cert(3) internally. Only certificates carrying RSA, Diffie-Hellman or EC keys are supported by this function. The *certificates* argument can be set to NULL if the CMS\_PARTIAL flag is set and recipients are added later using CMS\_add1\_recipient\_cert(3) or CMS\_add0\_recipient\_key(3).

*cipher* is the symmetric cipher to use. It must support ASN.1 encoding of its parameters. EVP\_des\_ede3\_cbc(3) (triple DES) is the algorithm of choice for S/MIME use because most clients support it.

Many browsers implement a "sign and encrypt" option which is simply an S/MIME *EnvelopedData* containing an S/MIME signed message. This can be readily produced by storing the S/MIME signed message in a memory BIO and passing it to **CMS\_encrypt**().

The following flags can be passed in the *flags* parameter:

- CMS\_TEXT

  MIME headers for type text/plain are prepended to the data.

- CMS\_BINARY

  Do not translate the supplied content into MIME canonical format even though that is required by the S/MIME specifications. This option should be used if the supplied data is in binary format. Otherwise, the translation will corrupt it. If CMS\_BINARY is set, then CMS\_TEXT is ignored.

- CMS\_USE\_KEYID

  Use the subject key identifier value to identify recipient certificates. An error occurs if all recipient certificates do not have a subject key identifier extension. By default, issuer name and serial number are used instead.

- CMS\_STREAM

  Return a partial *CMS\_ContentInfo* structure suitable for streaming I/O: no data is read from the BIO *in*. Several functions including SMIME\_write\_CMS(3), i2d\_CMS\_bio\_stream(3), or PEM\_write\_bio\_CMS\_stream(3) can be used  to finalize the structure. Alternatively, finalization can be performed by obtaining the streaming ASN1 *BIO* directly using BIO\_new\_CMS(3). Outputting the content of the returned *CMS\_ContentInfo* structure via a function that does not properly finalize it will give unpredictable results.

- CMS\_PARTIAL

  Return a partial *CMS\_ContentInfo* structure to which additional recipients and attributes can be added before finalization.

- CMS\_DETACHED

  Omit the data being encrypted from the *CMS\_ContentInfo* structure. This is rarely used in practice and is not supported by SMIME\_write\_CMS(3).

## RETURN VALUES

**CMS\_encrypt**() returns either a *CMS\_ContentInfo* structure or NULL if an error occurred. The error can be obtained from ERR\_get\_error(3).

## SEE ALSO

CMS\_add0\_cert(3), CMS\_add1\_recipient\_cert(3), CMS\_ContentInfo\_new(3), CMS\_decrypt(3)

## STANDARDS

RFC 5652: Cryptographic Message Syntax (CMS)

- section 6.1: EnvelopedData Type

- section 6.2.1: KeyTransRecipientInfo Type

## HISTORY

**CMS\_encrypt**() first appeared in OpenSSL 0.9.8h and has been available since OpenBSD 6.7.

The CMS\_STREAM flag first appeared in OpenSSL 1.0.0.