---
name: "libressl-ESS_SIGNING_CERT_new"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-ESS_SIGNING_CERT_new"
---

# libressl-ESS\_SIGNING\_CERT\_new(3)

signing certificates for S/MIME

## NAME

**ESS\_SIGNING\_CERT\_new**, **ESS\_SIGNING\_CERT\_free**, **ESS\_CERT\_ID\_new**, **ESS\_CERT\_ID\_free**, **ESS\_ISSUER\_SERIAL\_new**, **ESS\_ISSUER\_SERIAL\_free** – signing certificates for S/MIME

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/ts.h\>**

*ESS\_SIGNING\_CERT* *\**\

**ESS\_SIGNING\_CERT\_new**(*void*);

*void*\

**ESS\_SIGNING\_CERT\_free**(*ESS\_SIGNING\_CERT \*signing\_cert*);

*ESS\_CERT\_ID* *\**\

**ESS\_CERT\_ID\_new**(*void*);

*void*\

**ESS\_CERT\_ID\_free**(*ESS\_CERT\_ID \*cert\_id*);

*ESS\_ISSUER\_SERIAL* *\**\

**ESS\_ISSUER\_SERIAL\_new**(*void*);

*void*\

**ESS\_ISSUER\_SERIAL\_free**(*ESS\_ISSUER\_SERIAL \*issuer\_serial*);

## DESCRIPTION

The signing certificate may be included in the signedAttributes field of a *SignerInfo* structure to mitigate simple substitution and re-issue attacks.

**ESS\_SIGNING\_CERT\_new**() allocates and initializes an empty *ESS\_SIGNING\_CERT* object, representing an ASN.1 *SigningCertificate* structure defined in RFC 2634 section 5.4. It can hold the certificate used for signing the data, additional authorization certificates that can be used during validation, and policies applying to the certificate. **ESS\_SIGNING\_CERT\_free**() frees *signing\_cert*.

**ESS\_CERT\_ID\_new**() allocates and initializes an empty *ESS\_CERT\_ID* object, representing an ASN.1 *ESSCertID* structure defined in RFC 2634 section 5.4.1. Such objects can be used inside *ESS\_SIGNING\_CERT* objects, and each one can hold a SHA1 hash of one certificate. **ESS\_CERT\_ID\_free**() frees *cert\_id*.

**ESS\_ISSUER\_SERIAL\_new**() allocates and initializes an empty *ESS\_ISSUER\_SERIAL* object, representing an ASN.1 *IssuerSerial* structure defined in RFC 2634 section 5.4.1. It can hold an issuer name and a serial number and can be included in an *ESS\_CERT\_ID* object, which is useful for additional authorization certificates, but redundant for the signing certificate itself. **ESS\_ISSUER\_SERIAL\_free**() frees *issuer\_serial*.

## RETURN VALUES

**ESS\_SIGNING\_CERT\_new**(), **ESS\_CERT\_ID\_new**(), and **ESS\_ISSUER\_SERIAL\_new**() return the new *ESS\_SIGNING\_CERT*, *ESS\_CERT\_ID*, or *ESS\_ISSUER\_SERIAL* object, respectively, or NULL if an error occurred.

## SEE ALSO

d2i\_ESS\_SIGNING\_CERT(3)

## STANDARDS

RFC 2634: Enhanced Security Services for S/MIME, section 5: Signing Certificate Attribute

Note that RFC 2634 has been updated by RFC 5035: Enhanced Security Services (ESS) Update: Adding CertID Algorithm Agility. But the current implementation only supports the Signing Certificate Attribute Definition Version 1 according to RFC 2634, not the Signing Certificate Attribute Definition Version 2 according to RFC 5035.

## HISTORY

These functions first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9.