---
name: "libressl-PEM_X509_INFO_read_bio"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-PEM_X509_INFO_read_bio"
---

# libressl-PEM\_X509\_INFO\_read\_bio(3)

PEM and DER decode X.509 certificates, private keys, and revocation lists

## NAME

**PEM\_X509\_INFO\_read\_bio** – PEM and DER decode X.509 certificates, private keys, and revocation lists

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/pem.h\>**

*STACK\_OF(X509\_INFO)* *\**\

**PEM\_X509\_INFO\_read\_bio**(*BIO \*in\_bp*, *STACK\_OF(X509\_INFO) \*sk*, *pem\_password\_cb \*cb*, *void \*u*);

## DESCRIPTION

This function reads zero or more objects related to X.509 certificates from *in\_bp*, performs both PEM and DER decoding, and wraps the resulting objects in newly allocated *X509\_INFO* containers.

Setting *sk* to NULL is recommended, in which case a new stack is allocated, populated, and returned. If an existing *sk* is passed in, the created *X509\_INFO* objects are pushed onto that stack.

For PEM decoding, PEM\_read\_bio(3) is used internally, implying that any non-PEM data before, between, and after the objects is silently discarded.

For subsequent DER decoding, the decoding function and the field of the *X509\_INFO* structure to store the new object in are selected according to the PEM type name:

| | | |
| --- | --- | --- |
| PEM type name | decoder | *X509\_INFO* field |
| CERTIFICATE | d2i\_X509(3) | certificate |
| X509 CERTIFICATE | d2i\_X509(3) | certificate |
| TRUSTED CERTIFICATE | d2i\_X509\_AUX(3) | certificate |
| X509 CRL | d2i\_X509\_CRL(3) | revocation list |
| RSA PRIVATE KEY | d2i\_PrivateKey(3) | private key |
| DSA PRIVATE KEY | d2i\_PrivateKey(3) | private key |
| EC PRIVATE KEY | d2i\_PrivateKey(3) | private key |

Whenever the selected field is already occupied, another new *X509\_INFO* container is allocated and pushed onto the stack. Depending on the sequence of objects in the input, this can result in several partially populated *X509\_INFO* containers being pushed onto the stack.

PEM objects of types not listed in the above table are silently skipped.

Encrypted certificates and revocation lists are decrypted by calling PEM\_do\_header(3) internally, passing through the optional arguments *cb* and *u*. Encrypted private keys are not decrypted. Instead, the encrypted form is stored as read. All the same, PEM\_get\_EVP\_CIPHER\_INFO(3) is called internally to check that PEM headers, if there are any, are valid and specify an encryption the library is prepared to handle.

If any error occurs, objects that had already been read during the same call are deleted again and *sk* is left unchanged.

## RETURN VALUES

This function returns a pointer to the stack the objects read were pushed onto or NULL if an error occurs. It fails if PEM\_read\_bio(3), PEM\_get\_EVP\_CIPHER\_INFO(3), PEM\_do\_header(3), or DER decoding fails or if memory is exhausted.

## ERRORS

Diagnostics that can be retrieved with ERR\_get\_error(3), ERR\_GET\_REASON(3), and ERR\_reason\_error\_string(3) include:

- ERR\_R\_ASN1\_LIB "ASN1 lib"

  DER decoding of a PEM object failed.

- ERR\_R\_MALLOC\_FAILURE "malloc failure"

  **PEM\_X509\_INFO\_read\_bio**() failed to allocate a new *X509\_INFO*, *STACK\_OF(X509\_INFO)*, or *X509\_PKEY* object.

Additional types of errors can result from PEM\_read\_bio(3), PEM\_get\_EVP\_CIPHER\_INFO(3), and PEM\_do\_header(3).

After this function failed due to memory exhaustion, ERR\_get\_error(3) may sometimes return 0 anyway.

## SEE ALSO

BIO\_new(3), d2i\_PrivateKey(3), d2i\_X509(3), d2i\_X509\_CRL(3), EVP\_PKEY\_new(3), PEM\_read(3), PEM\_read\_bio\_PrivateKey(3), STACK\_OF(3), X509\_CRL\_new(3), X509\_INFO\_new(3), X509\_LOOKUP\_new(3), X509\_new(3)

## HISTORY

**PEM\_X509\_INFO\_read\_bio**() first appeared in SSLeay 0.6.0 and has been available since OpenBSD 2.4.

## CAVEATS

It is not an error if the input does not contain any objects of the desired types. In that case, nothing is added to *sk*, or if *sk* is NULL, a newly allocated, empty stack is returned. The only way to detect this situation is by comparing the number of objects on the stack before and after the call.

## BUGS

When reaching the end of the input, this function calls ERR\_clear\_error(3), which may hide errors that occurred before calling it.