---
name: "libressl-EVP_SignInit"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-EVP_SignInit"
---

# libressl-EVP\_SignInit(3)

EVP signing functions

## NAME

**EVP\_SignInit\_ex**, **EVP\_SignUpdate**, **EVP\_SignFinal**, **EVP\_SignInit** – EVP signing functions

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/evp.h\>**

*int*\

**EVP\_SignInit\_ex**(*EVP\_MD\_CTX \*ctx*, *const EVP\_MD \*type*, *ENGINE \*engine*);

*int*\

**EVP\_SignUpdate**(*EVP\_MD\_CTX \*ctx*, *const void \*d*, *unsigned int cnt*);

*int*\

**EVP\_SignFinal**(*EVP\_MD\_CTX \*ctx*, *unsigned char \*sig*, *unsigned int \*s*, *EVP\_PKEY \*pkey*);

*void*\

**EVP\_SignInit**(*EVP\_MD\_CTX \*ctx*, *const EVP\_MD \*type*);

## DESCRIPTION

The EVP signature routines are a high-level interface to digital signatures.

**EVP\_SignInit\_ex**() sets up the signing context *ctx* to use the digest *type*. Before calling this function, obtain *ctx* from EVP\_MD\_CTX\_new(3) or call EVP\_MD\_CTX\_reset(3) on it. The *engine* argument is always ignored and passing NULL is recommended.

**EVP\_SignUpdate**() hashes *cnt* bytes of data at *d* into the signature context *ctx*. This function can be called several times on the same *ctx* to include additional data.

**EVP\_SignFinal**() signs the data in *ctx* using the private key *pkey* and places the signature in *sig*. *sig* must be at least EVP\_PKEY\_size(3) bytes in size. *s* is an OUT parameter, and not used as an IN parameter. The number of bytes of data written (i.e. the length of the signature) will be written to the integer at *s*. At most EVP\_PKEY\_size(3) bytes will be written.

**EVP\_SignInit**() initializes a signing context *ctx* to use the default implementation of digest *type*.

The EVP interface to digital signatures should almost always be used in preference to the low-level interfaces. This is because the code then becomes transparent to the algorithm used and much more flexible.

The call to **EVP\_SignFinal**() internally finalizes a copy of the digest context. This means that calls to **EVP\_SignUpdate**() and **EVP\_SignFinal**() can be called later to digest and sign additional data.

Since only a copy of the digest context is ever finalized, the context must be cleaned up after use by calling EVP\_MD\_CTX\_free(3) or a memory leak will occur.

**EVP\_SignInit\_ex**(), **EVP\_SignUpdate**(), and **EVP\_SignInit**() are implemented as macros.

## RETURN VALUES

**EVP\_SignInit\_ex**(), **EVP\_SignUpdate**(), and **EVP\_SignFinal**() return 1 for success and 0 for failure.

The error codes can be obtained by ERR\_get\_error(3).

## SEE ALSO

evp(3), EVP\_DigestInit(3), EVP\_PKEY\_size(3), EVP\_VerifyInit(3)

## HISTORY

**EVP\_SignInit**(), **EVP\_SignUpdate**(), and **EVP\_SignFinal**() first appeared in SSLeay 0.5.1 and have been available since OpenBSD 2.4.

**EVP\_SignInit\_ex**() first appeared in OpenSSL 0.9.7 and has been available since OpenBSD 3.2.

## BUGS

Older versions of this documentation wrongly stated that calls to **EVP\_SignUpdate**() could not be made after calling **EVP\_SignFinal**().

Since the private key is passed in the call to **EVP\_SignFinal**(), any error relating to the private key (for example an unsuitable key and digest combination) will not be indicated until after potentially large amounts of data have been passed through **EVP\_SignUpdate**().

It is not possible to change the signing parameters using these function.

The previous two bugs are fixed in the newer EVP\_DigestSign\* function.